Fix/theme icon import

[vjan-nie]

fix(types): export FieldValidationState + astro check on every PR

Base: develop · Branch: fix/theme-icon-import · Reviewer: @Serjimen

Context

fe28db5 (@danielfdez17) already fixed the themeIcon import on develop. This PR doesn't touch
it. It adds the type export that was still missing, plus the CI gate that would have caught both.

@Serjimen, for context: the theme and email refactors moved code into src/lib/ but didn't
import everything back into src/scripts/main.ts:

• 5333085 moved themeIcon into theme-config.ts without importing it. That was a runtime
  ReferenceError: themeIcon is not defined in the Layout script, and the landing's Sign in
  button stopped working.
• f29a5d7 deleted type FieldValidationState from main.ts without exporting it from
  email-validation.ts. That left 3 × ts(2304), type-only with no runtime effect, which keep
  astro check red.

Nothing caught either one: the web image runs astro build, which never typechecks, and
publish.yml only builds and pushes images.

Commits

1. fix(types): export FieldValidationState from email-validation. EmailValidationResult.state
   now uses the exported union, and main.ts imports it.
2. ci: run astro check on every pull request (.github/workflows/typecheck.yml). It runs in
   node:22-alpine with pnpm 11.5.1, the same as the web Dockerfile. This is a PR gate, not a
   build step, so a type-only error blocks the merge but never a local make all.

Verification

• At ba930a3 (before the fixes), astro check reports 4 errors, including
  main.ts:303 Cannot find name 'themeIcon'.
• This branch, in node:22-alpine: astro check 0 errors (196 files) · vitest run 39/39 passed ·
  astro build Complete
• actionlint 1.7.12 (Docker): exit 0
• Live stack: the landing logs only the known T41 /api/auth/refresh 401. Sign in opens the
  form, and a real sign-in lands in the osionos shell.
• groot T43 e2e: FAILS on the rc2 image (landing pageerror: themeIcon is not defined) and
  PASSES with the fix.

Not covered

• The workflow hasn't run on GitHub yet. This PR is its first run.
• To make the check mandatory, add astro check as a required status check on develop and
  main (repo settings).