chore(e2e): add ESLint + Prettier; fix real findings; dedupe BASE

The Playwright suite had no linter and no formatter — only tsc. Add flat-config ESLint
(typescript-eslint, type-aware) and Prettier (2-space, matching the suite's style).

Rules keep the ones that catch real TEST bugs and drop the noise:
  - no-floating-promises KEPT — an un-awaited request/assertion can let a test end before it runs,
    passing vacuously. It caught one: the SSE reader loop in sse-listener is now explicitly `void`.
  - no-unused-vars KEPT — caught three dead bindings (an unused adminToken fixture arg, an unused
    `api` arg, an unused JPEG_MAGIC import), all removed.
  - no-explicit-any OFF — all test code; `any` is the honest type for an untyped res.json() body or
    a page.evaluate() return.
  - no-empty-pattern OFF — Playwright's dependency-free fixtures are `async ({}, use) => {}`.

Refactor: `const BASE = process.env.E2E_FRONTEND_URL ?? '...'` was redeclared verbatim in 23
files — extracted to helpers/env.ts and imported, so a port/scheme change is one edit not a sweep.

Then `prettier --write`. Verified: eslint clean, tsc clean, prettier clean, desktop suite 210
passed / 1 skipped. (One mobile spec flaked once under retries:0 — a pre-existing cross-test
reflow-timing vector from the flakiness audit, not this change: the each-key edit is stable across
16 isolated runs and a clean full mobile re-run.)

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

e2e/page-objects/host-dashboard.ts

@@ -11,8 +11,12 @@ export class HostDashboard {
   constructor(page: Page) {
     this.page = page;
     this.statsSection = page.locator('[data-testid="host-stats"]');
-    this.lockEventButton = page.getByRole('button', { name: /uploads sperren|event sperren|sperren/i }).first();
-    this.unlockEventButton = page.getByRole('button', { name: /uploads freigeben|entsperren/i }).first();
+    this.lockEventButton = page
+      .getByRole('button', { name: /uploads sperren|event sperren|sperren/i })
+      .first();
+    this.unlockEventButton = page
+      .getByRole('button', { name: /uploads freigeben|entsperren/i })
+      .first();
     this.releaseGalleryButton = page.getByRole('button', { name: /galerie freigeben/i });
     this.userSearchInput = page.getByPlaceholder(/suche|search/i).first();
   }
@@ -22,14 +26,23 @@ export class HostDashboard {
   }
 
   userRow(displayName: string): Locator {
-    return this.page.locator('tr,li,div', { hasText: displayName }).filter({ has: this.page.getByRole('button') }).first();
+    return this.page
+      .locator('tr,li,div', { hasText: displayName })
+      .filter({ has: this.page.getByRole('button') })
+      .first();
   }
 
   async banUser(displayName: string) {
     // A ban always hides — the confirm dialog is a plain confirm, no "hide uploads" checkbox
     // (removed from the UI; the endpoint takes no body).
     const row = this.userRow(displayName);
-    await row.getByRole('button', { name: /sperren/i }).first().click();
-    await this.page.getByRole('button', { name: /bestätigen|sperren/i }).last().click();
+    await row
+      .getByRole('button', { name: /sperren/i })
+      .first()
+      .click();
+    await this.page
+      .getByRole('button', { name: /bestätigen|sperren/i })
+      .last()
+      .click();
   }
 }