chore(e2e): add ESLint + Prettier; fix real findings; dedupe BASE

The Playwright suite had no linter and no formatter — only tsc. Add flat-config ESLint
(typescript-eslint, type-aware) and Prettier (2-space, matching the suite's style).

Rules keep the ones that catch real TEST bugs and drop the noise:
  - no-floating-promises KEPT — an un-awaited request/assertion can let a test end before it runs,
    passing vacuously. It caught one: the SSE reader loop in sse-listener is now explicitly `void`.
  - no-unused-vars KEPT — caught three dead bindings (an unused adminToken fixture arg, an unused
    `api` arg, an unused JPEG_MAGIC import), all removed.
  - no-explicit-any OFF — all test code; `any` is the honest type for an untyped res.json() body or
    a page.evaluate() return.
  - no-empty-pattern OFF — Playwright's dependency-free fixtures are `async ({}, use) => {}`.

Refactor: `const BASE = process.env.E2E_FRONTEND_URL ?? '...'` was redeclared verbatim in 23
files — extracted to helpers/env.ts and imported, so a port/scheme change is one edit not a sweep.

Then `prettier --write`. Verified: eslint clean, tsc clean, prettier clean, desktop suite 210
passed / 1 skipped. (One mobile spec flaked once under retries:0 — a pre-existing cross-test
reflow-timing vector from the flakiness audit, not this change: the each-key edit is stable across
16 isolated runs and a clean full mobile re-run.)

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

e2e/specs/02-upload/gallery-path.spec.ts

@@ -31,14 +31,25 @@ test.describe('Upload — gallery path', () => {
     const h = await guest('Uploader2');
     const { uploadRaw } = await import('../../helpers/upload-client');
     const { readFileSync } = await import('node:fs');
-    const r1 = await uploadRaw(h.jwt, readFileSync(SAMPLE_JPG), { filename: 'a.jpg', contentType: 'image/jpeg' });
-    const r2 = await uploadRaw(h.jwt, readFileSync(SAMPLE_JPG_2), { filename: 'b.jpg', contentType: 'image/jpeg' });
+    const r1 = await uploadRaw(h.jwt, readFileSync(SAMPLE_JPG), {
+      filename: 'a.jpg',
+      contentType: 'image/jpeg',
+    });
+    const r2 = await uploadRaw(h.jwt, readFileSync(SAMPLE_JPG_2), {
+      filename: 'b.jpg',
+      contentType: 'image/jpeg',
+    });
     expect(r1.status).toBe(201);
     expect(r2.status).toBe(201);
     await expect.poll(() => db.countUploadsForUser(h.userId), { timeout: 10_000 }).toBe(2);
   });
 
-  test('UI flow: FAB → UploadSheet → /upload → submit drives a real XHR upload', async ({ page, guest, signIn, db }) => {
+  test('UI flow: FAB → UploadSheet → /upload → submit drives a real XHR upload', async ({
+    page,
+    guest,
+    signIn,
+    db,
+  }) => {
     // Previously fixme'd: the UI queue never fired a POST. Root cause was NOT a
     // navigation/blob timing quirk but an IndexedDB upgrade bug — the v1→v2
     // `upgrade` callback opened a *new* transaction, which throws during a
@@ -74,13 +85,20 @@ test.describe('Upload — gallery path', () => {
       const { id } = await res.json();
 
       // Wait up to 10s for the compression worker's SSE.
-      const evt = await sse.waitForEvent('upload-processed', (e) => {
-        const data = typeof e.data === 'string' ? safeJson(e.data) : e.data;
-        return data?.upload_id === id || data?.id === id;
-      }, 10_000).catch(() => null);
+      const evt = await sse
+        .waitForEvent(
+          'upload-processed',
+          (e) => {
+            const data = typeof e.data === 'string' ? safeJson(e.data) : e.data;
+            return data?.upload_id === id || data?.id === id;
+          },
+          10_000
+        )
+        .catch(() => null);
 
       // If the SSE didn't arrive in 10s (slow CI, debug mode), at least we know the upload was accepted.
-      if (!evt) console.warn('[finding] upload-processed SSE did not arrive within 10s for upload', id);
+      if (!evt)
+        console.warn('[finding] upload-processed SSE did not arrive within 10s for upload', id);
     } finally {
       sse.stop();
     }
@@ -88,5 +106,9 @@ test.describe('Upload — gallery path', () => {
 });
 
 function safeJson(s: string) {
-  try { return JSON.parse(s); } catch { return s; }
+  try {
+    return JSON.parse(s);
+  } catch {
+    return s;
+  }
 }

e2e/specs/02-upload/quota.spec.ts

@@ -26,8 +26,8 @@ import { test, expect } from '../../fixtures/test';
 import { join } from 'node:path';
 import { readFileSync } from 'node:fs';
 import { uploadPausedMidStream } from '../../helpers/upload-client';
+import { BASE } from '../../helpers/env';
 
-const BASE = process.env.E2E_FRONTEND_URL ?? 'http://localhost:3101';
 const SAMPLE_BYTES = readFileSync(join(process.cwd(), 'fixtures', 'media', 'sample.jpg'));
 const SIZE = SAMPLE_BYTES.byteLength;
 
@@ -64,7 +64,10 @@ async function setLimitTo(
   targetBytes: number
 ): Promise<number> {
   const q = await quotaOf(jwt);
-  expect(q.free_disk_bytes, 'the disk must be readable, else quota fails OPEN and proves nothing').toBeTruthy();
+  expect(
+    q.free_disk_bytes,
+    'the disk must be readable, else quota fails OPEN and proves nothing'
+  ).toBeTruthy();
   const active = Math.max(q.active_uploaders, 1);
   const tolerance = (targetBytes * active) / (q.free_disk_bytes as number);
   await api.patchConfig(adminToken, { quota_tolerance: tolerance.toExponential(12) });
@@ -98,7 +101,9 @@ test.describe('Upload — storage quota enforcement', () => {
 
     // Nothing was accounted, and nothing reached the feed.
     expect((await quotaOf(g.jwt)).used_bytes).toBe(0);
-    const feed = await (await fetch(BASE + '/api/v1/feed', { headers: { Authorization: `Bearer ${g.jwt}` } })).json();
+    const feed = await (
+      await fetch(BASE + '/api/v1/feed', { headers: { Authorization: `Bearer ${g.jwt}` } })
+    ).json();
     expect(feed.uploads).toHaveLength(0);
   });
 

e2e/specs/02-upload/rate-limit.spec.ts

@@ -14,7 +14,11 @@ const SAMPLE_JPG = join(process.cwd(), 'fixtures', 'media', 'sample.jpg');
 const SAMPLE_BYTES = readFileSync(SAMPLE_JPG);
 
 test.describe('Upload — rate limit', () => {
-  test('4th upload in one hour returns 429 with Retry-After', async ({ api, adminToken, guest }) => {
+  test('4th upload in one hour returns 429 with Retry-After', async ({
+    api,
+    adminToken,
+    guest,
+  }) => {
     // Enable inside the test body, AFTER all auto-fixtures (truncate) have run,
     // so the config can't be reset out from under us by the ordering of hooks
     // vs fixtures.
@@ -53,7 +57,11 @@ test.describe('Upload — rate limit', () => {
     expect(limited.headers.get('retry-after')).toBeTruthy();
   });
 
-  test('flipping upload_rate_enabled off bypasses the limit', async ({ api, adminToken, guest }) => {
+  test('flipping upload_rate_enabled off bypasses the limit', async ({
+    api,
+    adminToken,
+    guest,
+  }) => {
     await api.patchConfig(adminToken, { upload_rate_enabled: 'false' });
 
     const h = await guest('NoQuota');