chore(e2e): add ESLint + Prettier; fix real findings; dedupe BASE

The Playwright suite had no linter and no formatter — only tsc. Add flat-config ESLint
(typescript-eslint, type-aware) and Prettier (2-space, matching the suite's style).

Rules keep the ones that catch real TEST bugs and drop the noise:
  - no-floating-promises KEPT — an un-awaited request/assertion can let a test end before it runs,
    passing vacuously. It caught one: the SSE reader loop in sse-listener is now explicitly `void`.
  - no-unused-vars KEPT — caught three dead bindings (an unused adminToken fixture arg, an unused
    `api` arg, an unused JPEG_MAGIC import), all removed.
  - no-explicit-any OFF — all test code; `any` is the honest type for an untyped res.json() body or
    a page.evaluate() return.
  - no-empty-pattern OFF — Playwright's dependency-free fixtures are `async ({}, use) => {}`.

Refactor: `const BASE = process.env.E2E_FRONTEND_URL ?? '...'` was redeclared verbatim in 23
files — extracted to helpers/env.ts and imported, so a port/scheme change is one edit not a sweep.

Then `prettier --write`. Verified: eslint clean, tsc clean, prettier clean, desktop suite 210
passed / 1 skipped. (One mobile spec flaked once under retries:0 — a pre-existing cross-test
reflow-timing vector from the flakiness audit, not this change: the each-key edit is stable across
16 isolated runs and a clean full mobile re-run.)

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

e2e/playwright.config.ts

@@ -21,7 +21,7 @@ const CHROMIUM_PERMISSIONS = ['camera', 'microphone', 'clipboard-read', 'clipboa
 export default defineConfig({
   testDir: './specs',
   outputDir: './test-results',
-  fullyParallel: false,            // Single shared backend → tests TRUNCATE between, so don't run in parallel.
+  fullyParallel: false, // Single shared backend → tests TRUNCATE between, so don't run in parallel.
   forbidOnly: !!process.env.CI,
   // NO RETRIES — not even in CI. This is deliberate and it is the opposite of the usual advice.
   //
@@ -42,11 +42,8 @@ export default defineConfig({
   //
   // A flake here is a bug report. Treat it as one.
   retries: 0,
-  workers: 1,                      // One worker. Multi-worker needs per-worker isolated DBs (Phase 2+).
-  reporter: [
-    ['list'],
-    ['html', { open: 'never', outputFolder: './playwright-report' }],
-  ],
+  workers: 1, // One worker. Multi-worker needs per-worker isolated DBs (Phase 2+).
+  reporter: [['list'], ['html', { open: 'never', outputFolder: './playwright-report' }]],
   globalSetup: './global-setup.ts',
   globalTeardown: './global-teardown.ts',
   timeout: 60_000,
@@ -104,7 +101,7 @@ export default defineConfig({
     {
       name: 'chromium-galaxy-s22',
       use: {
-        ...devices['Galaxy S9+'],         // Playwright doesn't ship S22 yet — S9+ is the closest Samsung descriptor.
+        ...devices['Galaxy S9+'], // Playwright doesn't ship S22 yet — S9+ is the closest Samsung descriptor.
         viewport: { width: 360, height: 780 },
         userAgent:
           'Mozilla/5.0 (Linux; Android 14; SM-S911B) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Mobile Safari/537.36',
@@ -160,8 +157,7 @@ export default defineConfig({
         // Firefox rejects `isMobile` (Chromium-only). Keep the phone viewport +
         // Android UA for coverage, but drop the unsupported flag.
         isMobile: false,
-        userAgent:
-          'Mozilla/5.0 (Android 14; Mobile; rv:124.0) Gecko/124.0 Firefox/124.0',
+        userAgent: 'Mozilla/5.0 (Android 14; Mobile; rv:124.0) Gecko/124.0 Firefox/124.0',
       },
       grep: /@smoke/,
     },