chore(e2e): add ESLint + Prettier; fix real findings; dedupe BASE

The Playwright suite had no linter and no formatter — only tsc. Add flat-config ESLint
(typescript-eslint, type-aware) and Prettier (2-space, matching the suite's style).

Rules keep the ones that catch real TEST bugs and drop the noise:
  - no-floating-promises KEPT — an un-awaited request/assertion can let a test end before it runs,
    passing vacuously. It caught one: the SSE reader loop in sse-listener is now explicitly `void`.
  - no-unused-vars KEPT — caught three dead bindings (an unused adminToken fixture arg, an unused
    `api` arg, an unused JPEG_MAGIC import), all removed.
  - no-explicit-any OFF — all test code; `any` is the honest type for an untyped res.json() body or
    a page.evaluate() return.
  - no-empty-pattern OFF — Playwright's dependency-free fixtures are `async ({}, use) => {}`.

Refactor: `const BASE = process.env.E2E_FRONTEND_URL ?? '...'` was redeclared verbatim in 23
files — extracted to helpers/env.ts and imported, so a port/scheme change is one edit not a sweep.

Then `prettier --write`. Verified: eslint clean, tsc clean, prettier clean, desktop suite 210
passed / 1 skipped. (One mobile spec flaked once under retries:0 — a pre-existing cross-test
reflow-timing vector from the flakiness audit, not this change: the each-key edit is stable across
16 isolated runs and a clean full mobile re-run.)

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

e2e/specs/06-export/export-leak.spec.ts

@@ -12,8 +12,7 @@
  */
 import { test, expect } from '../../fixtures/test';
 import { seedUpload } from '../../helpers/seed';
-
-const BASE = process.env.E2E_FRONTEND_URL ?? 'http://localhost:3101';
+import { BASE } from '../../helpers/env';
 
 test.describe('Export — no public leak (CR2)', () => {
   test('a real export is downloadable only via the gated endpoint, never via /media', async ({
@@ -26,7 +25,10 @@ test.describe('Export — no public leak (CR2)', () => {
     await seedUpload(host.jwt, { caption: 'in the export' });
 
     // Host releases the gallery → spawns the real zip/html export jobs.
-    const rel = await fetch(`${BASE}/api/v1/host/gallery/release`, { method: 'POST', headers: bearer });
+    const rel = await fetch(`${BASE}/api/v1/host/gallery/release`, {
+      method: 'POST',
+      headers: bearer,
+    });
     expect(rel.status).toBe(204);
 
     // Wait for the real zip job to finish writing the archive to disk.
@@ -49,7 +51,10 @@ test.describe('Export — no public leak (CR2)', () => {
 
     // …but IS retrievable via the gated single-use ticket endpoint. This proves the
     // 404 above means "not public", not merely "no file was produced".
-    const ticketRes = await fetch(`${BASE}/api/v1/export/ticket`, { method: 'POST', headers: bearer });
+    const ticketRes = await fetch(`${BASE}/api/v1/export/ticket`, {
+      method: 'POST',
+      headers: bearer,
+    });
     const { ticket } = await ticketRes.json();
     const dl = await fetch(`${BASE}/api/v1/export/zip?ticket=${encodeURIComponent(ticket)}`);
     expect(dl.status).toBe(200);

e2e/specs/06-export/export-video.spec.ts

@@ -14,8 +14,7 @@ import { test, expect } from '../../fixtures/test';
 import { uploadRaw } from '../../helpers/upload-client';
 import { readFileSync } from 'node:fs';
 import { join } from 'node:path';
-
-const BASE = process.env.E2E_FRONTEND_URL ?? 'http://localhost:3101';
+import { BASE } from '../../helpers/env';
 
 test.describe('Export — video streaming (P4)', () => {
   test('a real video upload is streamed into Memories.zip (not dropped)', async ({ host }) => {
@@ -29,7 +28,10 @@ test.describe('Export — video streaming (P4)', () => {
     const { id } = await up.json();
 
     // Release the gallery → spawns the real zip + html export jobs.
-    const rel = await fetch(`${BASE}/api/v1/host/gallery/release`, { method: 'POST', headers: bearer });
+    const rel = await fetch(`${BASE}/api/v1/host/gallery/release`, {
+      method: 'POST',
+      headers: bearer,
+    });
     expect(rel.status).toBe(204);
 
     // Wait for the HTML (Memories.zip) job — that's the one whose media staging P4 changed.
@@ -44,7 +46,10 @@ test.describe('Export — video streaming (P4)', () => {
       .toBe('done');
 
     // Download Memories.zip via the gated single-use ticket.
-    const ticketRes = await fetch(`${BASE}/api/v1/export/ticket`, { method: 'POST', headers: bearer });
+    const ticketRes = await fetch(`${BASE}/api/v1/export/ticket`, {
+      method: 'POST',
+      headers: bearer,
+    });
     const { ticket } = await ticketRes.json();
     const dl = await fetch(`${BASE}/api/v1/export/html?ticket=${encodeURIComponent(ticket)}`);
     expect(dl.status).toBe(200);

e2e/specs/06-export/export.spec.ts

@@ -11,7 +11,11 @@ import { ExportPage } from '../../page-objects';
 const SLUG = 'e2e-test-event';
 
 test.describe('Export — release and download', () => {
-  test('/export shows the "not yet available" state before release', async ({ page, guest, signIn }) => {
+  test('/export shows the "not yet available" state before release', async ({
+    page,
+    guest,
+    signIn,
+  }) => {
     const g = await guest('PreRelease');
     await signIn(page, g);
     const exportPage = new ExportPage(page);
@@ -55,9 +59,12 @@ test.describe('Export — release and download', () => {
   test('export status API reflects released flag', async ({ guest, db }) => {
     const g = await guest('ReleaseQuery');
 
-    let res = await fetch((process.env.E2E_FRONTEND_URL ?? 'http://localhost:3101') + '/api/v1/export/status', {
-      headers: { Authorization: `Bearer ${g.jwt}` },
-    });
+    let res = await fetch(
+      (process.env.E2E_FRONTEND_URL ?? 'http://localhost:3101') + '/api/v1/export/status',
+      {
+        headers: { Authorization: `Bearer ${g.jwt}` },
+      }
+    );
     let body: any = await res.json();
     expect(body.released).toBe(false);
 
@@ -65,9 +72,12 @@ test.describe('Export — release and download', () => {
     await db.fakeExportJob(SLUG, 'zip', 'done');
     await db.fakeExportJob(SLUG, 'html', 'done');
 
-    res = await fetch((process.env.E2E_FRONTEND_URL ?? 'http://localhost:3101') + '/api/v1/export/status', {
-      headers: { Authorization: `Bearer ${g.jwt}` },
-    });
+    res = await fetch(
+      (process.env.E2E_FRONTEND_URL ?? 'http://localhost:3101') + '/api/v1/export/status',
+      {
+        headers: { Authorization: `Bearer ${g.jwt}` },
+      }
+    );
     body = await res.json();
     expect(body.released).toBe(true);
     expect(body.zip.status).toBe('done');