chore(e2e): add ESLint + Prettier; fix real findings; dedupe BASE

The Playwright suite had no linter and no formatter — only tsc. Add flat-config ESLint
(typescript-eslint, type-aware) and Prettier (2-space, matching the suite's style).

Rules keep the ones that catch real TEST bugs and drop the noise:
  - no-floating-promises KEPT — an un-awaited request/assertion can let a test end before it runs,
    passing vacuously. It caught one: the SSE reader loop in sse-listener is now explicitly `void`.
  - no-unused-vars KEPT — caught three dead bindings (an unused adminToken fixture arg, an unused
    `api` arg, an unused JPEG_MAGIC import), all removed.
  - no-explicit-any OFF — all test code; `any` is the honest type for an untyped res.json() body or
    a page.evaluate() return.
  - no-empty-pattern OFF — Playwright's dependency-free fixtures are `async ({}, use) => {}`.

Refactor: `const BASE = process.env.E2E_FRONTEND_URL ?? '...'` was redeclared verbatim in 23
files — extracted to helpers/env.ts and imported, so a port/scheme change is one edit not a sweep.

Then `prettier --write`. Verified: eslint clean, tsc clean, prettier clean, desktop suite 210
passed / 1 skipped. (One mobile spec flaked once under retries:0 — a pre-existing cross-test
reflow-timing vector from the flakiness audit, not this change: the each-key edit is stable across
16 isolated runs and a clean full mobile re-run.)

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

e2e/specs/05-admin/authorization.spec.ts

@@ -4,8 +4,7 @@
  * guest can't hit host/admin; host can't hit admin.
  */
 import { test, expect } from '../../fixtures/test';
-
-const BASE = process.env.E2E_FRONTEND_URL ?? 'http://localhost:3101';
+import { BASE } from '../../helpers/env';
 
 test.describe('Authorization escalation guards', () => {
   test('guest → POST /host/event/close returns 403', async ({ guest }) => {

e2e/specs/05-admin/authz-sweep.spec.ts

@@ -19,8 +19,7 @@
  * still download the keepsake) is BY DESIGN, and is asserted in 07-adversarial/authorization-deep.
  */
 import { test, expect } from '../../fixtures/test';
-
-const BASE = process.env.E2E_FRONTEND_URL ?? 'http://localhost:3101';
+import { BASE } from '../../helpers/env';
 
 type Method = 'GET' | 'POST' | 'PATCH' | 'DELETE';
 interface Route {
@@ -37,23 +36,66 @@ const ROUTES: Route[] = [
   { method: 'GET', path: () => '/api/v1/host/event', name: 'GET /host/event' },
   { method: 'POST', path: () => '/api/v1/host/event/close', name: 'POST /host/event/close' },
   { method: 'POST', path: () => '/api/v1/host/event/open', name: 'POST /host/event/open' },
-  { method: 'POST', path: () => '/api/v1/host/gallery/release', name: 'POST /host/gallery/release' },
+  {
+    method: 'POST',
+    path: () => '/api/v1/host/gallery/release',
+    name: 'POST /host/gallery/release',
+  },
   { method: 'POST', path: () => '/api/v1/host/export/rebuild', name: 'POST /host/export/rebuild' },
   { method: 'GET', path: () => '/api/v1/host/users', name: 'GET /host/users' },
-  { method: 'POST', path: (v) => `/api/v1/host/users/${v}/ban`, name: 'POST /host/users/{id}/ban', body: {} },
-  { method: 'POST', path: (v) => `/api/v1/host/users/${v}/unban`, name: 'POST /host/users/{id}/unban', body: {} },
-  { method: 'PATCH', path: (v) => `/api/v1/host/users/${v}/role`, name: 'PATCH /host/users/{id}/role', body: { role: 'host' } },
-  { method: 'POST', path: (v) => `/api/v1/host/users/${v}/pin-reset`, name: 'POST /host/users/{id}/pin-reset', body: {} },
-  { method: 'GET', path: () => '/api/v1/host/pin-reset-requests', name: 'GET /host/pin-reset-requests' },
-  { method: 'DELETE', path: (v) => `/api/v1/host/pin-reset-requests/${v}`, name: 'DELETE /host/pin-reset-requests/{id}' },
+  {
+    method: 'POST',
+    path: (v) => `/api/v1/host/users/${v}/ban`,
+    name: 'POST /host/users/{id}/ban',
+    body: {},
+  },
+  {
+    method: 'POST',
+    path: (v) => `/api/v1/host/users/${v}/unban`,
+    name: 'POST /host/users/{id}/unban',
+    body: {},
+  },
+  {
+    method: 'PATCH',
+    path: (v) => `/api/v1/host/users/${v}/role`,
+    name: 'PATCH /host/users/{id}/role',
+    body: { role: 'host' },
+  },
+  {
+    method: 'POST',
+    path: (v) => `/api/v1/host/users/${v}/pin-reset`,
+    name: 'POST /host/users/{id}/pin-reset',
+    body: {},
+  },
+  {
+    method: 'GET',
+    path: () => '/api/v1/host/pin-reset-requests',
+    name: 'GET /host/pin-reset-requests',
+  },
+  {
+    method: 'DELETE',
+    path: (v) => `/api/v1/host/pin-reset-requests/${v}`,
+    name: 'DELETE /host/pin-reset-requests/{id}',
+  },
   { method: 'DELETE', path: (v) => `/api/v1/host/upload/${v}`, name: 'DELETE /host/upload/{id}' },
   { method: 'DELETE', path: (v) => `/api/v1/host/comment/${v}`, name: 'DELETE /host/comment/{id}' },
 
   // ── Admin surface ───────────────────────────────────────────────────────
   { method: 'GET', path: () => '/api/v1/admin/stats', name: 'GET /admin/stats', adminOnly: true },
   { method: 'GET', path: () => '/api/v1/admin/config', name: 'GET /admin/config', adminOnly: true },
-  { method: 'PATCH', path: () => '/api/v1/admin/config', name: 'PATCH /admin/config', adminOnly: true, body: { quota_enabled: 'false' } },
-  { method: 'GET', path: () => '/api/v1/admin/export/jobs', name: 'GET /admin/export/jobs', adminOnly: true },
+  {
+    method: 'PATCH',
+    path: () => '/api/v1/admin/config',
+    name: 'PATCH /admin/config',
+    adminOnly: true,
+    body: { quota_enabled: 'false' },
+  },
+  {
+    method: 'GET',
+    path: () => '/api/v1/admin/export/jobs',
+    name: 'GET /admin/export/jobs',
+    adminOnly: true,
+  },
 ];
 
 async function call(route: Route, jwt: string, victimId: string): Promise<number> {
@@ -89,7 +131,10 @@ test.describe('Authorization sweep — every privileged route', () => {
 
       const status = await call(route, host.jwt, victim.userId);
 
-      expect(status, `${route.name} is admin-only and must reject a host with 403, got ${status}`).toBe(403);
+      expect(
+        status,
+        `${route.name} is admin-only and must reject a host with 403, got ${status}`
+      ).toBe(403);
     });
   }
 
@@ -121,9 +166,10 @@ test.describe('Authorization sweep — every privileged route', () => {
         headers: route.body !== undefined ? { 'Content-Type': 'application/json' } : {},
         ...(route.body !== undefined ? { body: JSON.stringify(route.body) } : {}),
       });
-      expect([401, 403], `${route.name} must reject an anonymous caller, got ${res.status}`).toContain(
-        res.status
-      );
+      expect(
+        [401, 403],
+        `${route.name} must reject an anonymous caller, got ${res.status}`
+      ).toContain(res.status);
     }
   });
 });

e2e/specs/05-admin/config.spec.ts

@@ -13,21 +13,27 @@ test.describe('Admin — config API', () => {
     await api.patchConfig(adminToken, { max_image_size_mb: '20' });
   });
 
-  test('non-numeric value for a numeric key is rejected', async ({ api, adminToken }) => {
-    const res = await fetch((process.env.E2E_FRONTEND_URL ?? 'http://localhost:3101') + '/api/v1/admin/config', {
-      method: 'PATCH',
-      headers: { Authorization: `Bearer ${adminToken}`, 'Content-Type': 'application/json' },
-      body: JSON.stringify({ max_image_size_mb: 'not-a-number' }),
-    });
+  test('non-numeric value for a numeric key is rejected', async ({ adminToken }) => {
+    const res = await fetch(
+      (process.env.E2E_FRONTEND_URL ?? 'http://localhost:3101') + '/api/v1/admin/config',
+      {
+        method: 'PATCH',
+        headers: { Authorization: `Bearer ${adminToken}`, 'Content-Type': 'application/json' },
+        body: JSON.stringify({ max_image_size_mb: 'not-a-number' }),
+      }
+    );
     expect(res.status).toBe(400);
   });
 
   test('unknown config key is rejected (whitelist enforced)', async ({ adminToken }) => {
-    const res = await fetch((process.env.E2E_FRONTEND_URL ?? 'http://localhost:3101') + '/api/v1/admin/config', {
-      method: 'PATCH',
-      headers: { Authorization: `Bearer ${adminToken}`, 'Content-Type': 'application/json' },
-      body: JSON.stringify({ totally_fake_key: '1' }),
-    });
+    const res = await fetch(
+      (process.env.E2E_FRONTEND_URL ?? 'http://localhost:3101') + '/api/v1/admin/config',
+      {
+        method: 'PATCH',
+        headers: { Authorization: `Bearer ${adminToken}`, 'Content-Type': 'application/json' },
+        body: JSON.stringify({ totally_fake_key: '1' }),
+      }
+    );
     expect(res.status).toBe(400);
   });
 
@@ -40,16 +46,23 @@ test.describe('Admin — config API', () => {
     cfg = await api.getConfig(adminToken);
     expect(cfg.upload_rate_enabled).toBe('false');
 
-    const res = await fetch((process.env.E2E_FRONTEND_URL ?? 'http://localhost:3101') + '/api/v1/admin/config', {
-      method: 'PATCH',
-      headers: { Authorization: `Bearer ${adminToken}`, 'Content-Type': 'application/json' },
-      body: JSON.stringify({ upload_rate_enabled: 'maybe' }),
-    });
+    const res = await fetch(
+      (process.env.E2E_FRONTEND_URL ?? 'http://localhost:3101') + '/api/v1/admin/config',
+      {
+        method: 'PATCH',
+        headers: { Authorization: `Bearer ${adminToken}`, 'Content-Type': 'application/json' },
+        body: JSON.stringify({ upload_rate_enabled: 'maybe' }),
+      }
+    );
     expect(res.status).toBe(400);
   });
 
-  test('privacy_note round-trips verbatim, preserving whitespace + newlines', async ({ api, adminToken }) => {
-    const note = '   Datenschutz\n  • Wir verwenden keine Cookies.\n  • Alles bleibt im Browser.\n\n— Dein Host';
+  test('privacy_note round-trips verbatim, preserving whitespace + newlines', async ({
+    api,
+    adminToken,
+  }) => {
+    const note =
+      '   Datenschutz\n  • Wir verwenden keine Cookies.\n  • Alles bleibt im Browser.\n\n— Dein Host';
     await api.patchConfig(adminToken, { privacy_note: note });
     const cfg = await api.getConfig(adminToken);
     expect(cfg.privacy_note).toBe(note);
@@ -58,7 +71,11 @@ test.describe('Admin — config API', () => {
 });
 
 test.describe('Admin — stats', () => {
-  test('GET /admin/stats returns matching counts after seeding users', async ({ api, adminToken, guest }) => {
+  test('GET /admin/stats returns matching counts after seeding users', async ({
+    api,
+    adminToken,
+    guest,
+  }) => {
     await guest('Stat1');
     await guest('Stat2');
     await guest('Stat3');