chore(e2e): add ESLint + Prettier; fix real findings; dedupe BASE

The Playwright suite had no linter and no formatter — only tsc. Add flat-config ESLint
(typescript-eslint, type-aware) and Prettier (2-space, matching the suite's style).

Rules keep the ones that catch real TEST bugs and drop the noise:
  - no-floating-promises KEPT — an un-awaited request/assertion can let a test end before it runs,
    passing vacuously. It caught one: the SSE reader loop in sse-listener is now explicitly `void`.
  - no-unused-vars KEPT — caught three dead bindings (an unused adminToken fixture arg, an unused
    `api` arg, an unused JPEG_MAGIC import), all removed.
  - no-explicit-any OFF — all test code; `any` is the honest type for an untyped res.json() body or
    a page.evaluate() return.
  - no-empty-pattern OFF — Playwright's dependency-free fixtures are `async ({}, use) => {}`.

Refactor: `const BASE = process.env.E2E_FRONTEND_URL ?? '...'` was redeclared verbatim in 23
files — extracted to helpers/env.ts and imported, so a port/scheme change is one edit not a sweep.

Then `prettier --write`. Verified: eslint clean, tsc clean, prettier clean, desktop suite 210
passed / 1 skipped. (One mobile spec flaked once under retries:0 — a pre-existing cross-test
reflow-timing vector from the flakiness audit, not this change: the each-key edit is stable across
16 isolated runs and a clean full mobile re-run.)

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

e2e/specs/04-host/event-lock.spec.ts

@@ -5,13 +5,16 @@
  * for a guest who's already viewing the feed.
  */
 import { test, expect } from '../../fixtures/test';
+import { BASE } from '../../helpers/env';
 
 test.describe('Host — event lock', () => {
-  test('closing the event via API sets uploads_locked_at; opening clears it', async ({ host, api }) => {
+  test('closing the event via API sets uploads_locked_at; opening clears it', async ({
+    host,
+    api,
+  }) => {
     // The frontend doesn't (yet) render a per-guest "uploads locked" banner on
     // the feed — that's the journey §9 banner, currently a UX gap. We assert
     // the API + DB contract here and leave the banner check for once it ships.
-    const BASE = process.env.E2E_FRONTEND_URL ?? 'http://localhost:3101';
 
     await api.closeEvent(host.jwt);
     const evRes = await fetch(`${BASE}/api/v1/host/event`, {
@@ -38,8 +41,11 @@ test.describe('Host — event lock', () => {
   // event (USER_JOURNEYS §9.3, FEATURES capability matrix). Only new uploads are
   // rejected. (An earlier revision froze social interaction too; that contradicted
   // the documented behavior and was reverted.)
-  test('a closed event still allows likes and comments, but blocks new uploads', async ({ api, host, guest }) => {
-    const BASE = process.env.E2E_FRONTEND_URL ?? 'http://localhost:3101';
+  test('a closed event still allows likes and comments, but blocks new uploads', async ({
+    api,
+    host,
+    guest,
+  }) => {
     const g = await guest('SocialLocked');
 
     // Upload while still open so there's a target to interact with.

e2e/specs/04-host/moderation.spec.ts

@@ -7,7 +7,11 @@ import { test, expect } from '../../fixtures/test';
 import { seedUpload, seedComment } from '../../helpers/seed';
 
 test.describe('Host — moderation API', () => {
-  test('ban always hides — a banned user is is_banned AND uploads_hidden (USER_JOURNEYS §9.5)', async ({ api, host, guest }) => {
+  test('ban always hides — a banned user is is_banned AND uploads_hidden (USER_JOURNEYS §9.5)', async ({
+    api,
+    host,
+    guest,
+  }) => {
     // Ban is unconditionally a hide: a banned user's content is "gone" everywhere. The endpoint
     // takes no body and there is no per-request opt-out (the legacy hide_uploads flag is gone).
     const target = await guest('Banned2');
@@ -23,11 +27,14 @@ test.describe('Host — moderation API', () => {
     await api.banUser(host.jwt, target.userId);
 
     // Direct fetch — multipart body shape is just a marker; the auth middleware should reject before parsing.
-    const res = await fetch((process.env.E2E_FRONTEND_URL ?? 'http://localhost:3101') + '/api/v1/upload', {
-      method: 'POST',
-      headers: { Authorization: `Bearer ${target.jwt}` },
-      body: new FormData(),
-    });
+    const res = await fetch(
+      (process.env.E2E_FRONTEND_URL ?? 'http://localhost:3101') + '/api/v1/upload',
+      {
+        method: 'POST',
+        headers: { Authorization: `Bearer ${target.jwt}` },
+        body: new FormData(),
+      }
+    );
     expect(res.status).toBe(403);
   });
 
@@ -87,15 +94,20 @@ test.describe('Host — live role/ban revocation (H1)', () => {
 
   test('a banned host cannot unban themselves', async ({ api, adminToken, host }) => {
     await api.banUser(adminToken, host.userId);
-    await expect(
-      api.unbanUser(host.jwt, host.userId, { expectedStatus: [204] })
-    ).rejects.toThrow(/→ 403/);
+    await expect(api.unbanUser(host.jwt, host.userId, { expectedStatus: [204] })).rejects.toThrow(
+      /→ 403/
+    );
   });
 
   // H1 / USER_JOURNEYS §10: a banned user keeps *read* access but every write is
   // rejected with 403. The ban is enforced on write handlers + Require{Host,Admin},
   // NOT in the base extractor (which would wrongly block reads too).
-  test('a banned user keeps read access but is blocked from writes', async ({ api, host, guest, db }) => {
+  test('a banned user keeps read access but is blocked from writes', async ({
+    api,
+    host,
+    guest,
+    db,
+  }) => {
     const base = process.env.E2E_FRONTEND_URL ?? 'http://localhost:3101';
     const target = await guest('BannedRW');
     const auth = (jwt: string) => ({ Authorization: `Bearer ${jwt}` });

e2e/specs/04-host/sse-eviction.spec.ts

@@ -7,8 +7,7 @@
 import { test, expect } from '../../fixtures/test';
 import { seedUpload } from '../../helpers/seed';
 import { SseListener } from '../../helpers/sse-listener';
-
-const BASE = process.env.E2E_FRONTEND_URL ?? 'http://localhost:3101';
+import { BASE } from '../../helpers/env';
 
 test.describe('Host — live SSE eviction (H3)', () => {
   test('self-deleting an upload broadcasts upload-deleted', async ({ guest }) => {
@@ -24,17 +23,10 @@ test.describe('Host — live SSE eviction (H3)', () => {
     });
     expect(res.status).toBe(204);
 
-    await sse.waitForEvent(
-      'upload-deleted',
-      (e) => e.data.upload_id === uploadId
-    );
+    await sse.waitForEvent('upload-deleted', (e) => e.data.upload_id === uploadId);
   });
 
-  test('banning a user broadcasts user-hidden', async ({
-    api,
-    host,
-    guest,
-  }) => {
+  test('banning a user broadcasts user-hidden', async ({ api, host, guest }) => {
     const target = await guest('HideTarget');
     await seedUpload(target.jwt, { caption: 'should vanish' });
 
@@ -43,10 +35,7 @@ test.describe('Host — live SSE eviction (H3)', () => {
 
     await api.banUser(host.jwt, target.userId);
 
-    await sse.waitForEvent(
-      'user-hidden',
-      (e) => e.data.user_id === target.userId
-    );
+    await sse.waitForEvent('user-hidden', (e) => e.data.user_id === target.userId);
   });
 
   // Frontend regression: the broadcasts above are inert if the client never