chore(e2e): add ESLint + Prettier; fix real findings; dedupe BASE

The Playwright suite had no linter and no formatter — only tsc. Add flat-config ESLint
(typescript-eslint, type-aware) and Prettier (2-space, matching the suite's style).

Rules keep the ones that catch real TEST bugs and drop the noise:
  - no-floating-promises KEPT — an un-awaited request/assertion can let a test end before it runs,
    passing vacuously. It caught one: the SSE reader loop in sse-listener is now explicitly `void`.
  - no-unused-vars KEPT — caught three dead bindings (an unused adminToken fixture arg, an unused
    `api` arg, an unused JPEG_MAGIC import), all removed.
  - no-explicit-any OFF — all test code; `any` is the honest type for an untyped res.json() body or
    a page.evaluate() return.
  - no-empty-pattern OFF — Playwright's dependency-free fixtures are `async ({}, use) => {}`.

Refactor: `const BASE = process.env.E2E_FRONTEND_URL ?? '...'` was redeclared verbatim in 23
files — extracted to helpers/env.ts and imported, so a port/scheme change is one edit not a sweep.

Then `prettier --write`. Verified: eslint clean, tsc clean, prettier clean, desktop suite 210
passed / 1 skipped. (One mobile spec flaked once under retries:0 — a pre-existing cross-test
reflow-timing vector from the flakiness audit, not this change: the each-key edit is stable across
16 isolated runs and a clean full mobile re-run.)

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

e2e/helpers/env.ts

@@ -0,0 +1,5 @@
+/**
+ * Shared test environment constants. The frontend base URL was redeclared verbatim in ~23 specs;
+ * one source of truth means a port/scheme change is a single edit, not a sweep.
+ */
+export const BASE = process.env.E2E_FRONTEND_URL ?? 'http://localhost:3101';

e2e/helpers/seed.ts

@@ -7,8 +7,7 @@ import { readFileSync } from 'node:fs';
 import { join } from 'node:path';
 import { uploadRaw } from './upload-client';
 import { db } from '../fixtures/db';
-
-const BASE = process.env.E2E_FRONTEND_URL ?? 'http://localhost:3101';
+import { BASE } from './env';
 
 // A real, decodable JPEG. Magic-bytes-only fakes now get auto-cleaned by the
 // backend when compression fails (a failed transcode refunds quota + deletes the

e2e/helpers/sse-listener.ts

@@ -30,7 +30,8 @@ export class SseListener {
     const reader = res.body.getReader();
     const decoder = new TextDecoder();
     let buffer = '';
-    (async () => {
+    // Fire-and-forget reader loop; the caller drives lifecycle via stop()/the AbortController.
+    void (async () => {
       try {
         while (!this.closed) {
           const { done, value } = await reader.read();
@@ -61,7 +62,9 @@ export class SseListener {
       if (hit) return hit;
       await new Promise((r) => setTimeout(r, 50));
     }
-    throw new Error(`SSE event ${type} did not arrive within ${timeoutMs}ms. Got: ${this.events.map((e) => e.type).join(', ')}`);
+    throw new Error(
+      `SSE event ${type} did not arrive within ${timeoutMs}ms. Got: ${this.events.map((e) => e.type).join(', ')}`
+    );
   }
 
   allEvents(): SseEvent[] {

e2e/helpers/sse.ts

@@ -4,8 +4,7 @@
  * it lives in one place instead of being re-inlined per spec.
  */
 import type { Page } from '@playwright/test';
-
-const BASE = process.env.E2E_FRONTEND_URL ?? 'http://localhost:3101';
+import { BASE } from './env';
 
 /** Exchange a JWT for a single-use SSE ticket via POST /api/v1/stream/ticket. */
 export async function mintSseTicket(jwt: string): Promise<string> {
@@ -13,7 +12,8 @@ export async function mintSseTicket(jwt: string): Promise<string> {
     method: 'POST',
     headers: { Authorization: `Bearer ${jwt}` },
   });
-  if (res.status !== 200) throw new Error(`mintSseTicket failed: ${res.status} ${await res.text()}`);
+  if (res.status !== 200)
+    throw new Error(`mintSseTicket failed: ${res.status} ${await res.text()}`);
   return (await res.json()).ticket;
 }
 

e2e/helpers/upload-client.ts

@@ -1,3 +1,4 @@
+import { BASE } from './env';
 /**
  * Node-side multipart upload helper. Lets adversarial specs post arbitrary
  * bytes with arbitrary `Content-Type` claims to /api/v1/upload without
@@ -11,8 +12,6 @@
  */
 // Node 22+ ships FormData and Blob as globals — no import needed.
 
-const BASE = process.env.E2E_FRONTEND_URL ?? 'http://localhost:3101';
-
 export type UploadOptions = {
   filename?: string;
   contentType?: string;
@@ -20,7 +19,11 @@ export type UploadOptions = {
   hashtags?: string;
 };
 
-export async function uploadRaw(token: string, body: Uint8Array | Buffer, opts: UploadOptions = {}) {
+export async function uploadRaw(
+  token: string,
+  body: Uint8Array | Buffer,
+  opts: UploadOptions = {}
+) {
   const form = new FormData();
   const blob = new Blob([body as any], { type: opts.contentType ?? 'application/octet-stream' });
   form.append('file', blob as any, opts.filename ?? 'upload.bin');
@@ -41,7 +44,9 @@ export async function uploadFile(token: string, path: string, opts: UploadOption
 }
 
 /** Tiny valid JPEG header — magic bytes only, useful for "claim image but is N MB of zeros" tests. */
-export const JPEG_MAGIC = new Uint8Array([0xff, 0xd8, 0xff, 0xe0, 0x00, 0x10, 0x4a, 0x46, 0x49, 0x46]);
+export const JPEG_MAGIC = new Uint8Array([
+  0xff, 0xd8, 0xff, 0xe0, 0x00, 0x10, 0x4a, 0x46, 0x49, 0x46,
+]);
 /** Tiny valid PNG magic bytes. */
 export const PNG_MAGIC = new Uint8Array([0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a]);
 /** ELF header — the magic bytes of a Linux executable. `infer` reports `application/x-executable`. */