chore(e2e): add ESLint + Prettier; fix real findings; dedupe BASE

The Playwright suite had no linter and no formatter — only tsc. Add flat-config ESLint
(typescript-eslint, type-aware) and Prettier (2-space, matching the suite's style).

Rules keep the ones that catch real TEST bugs and drop the noise:
  - no-floating-promises KEPT — an un-awaited request/assertion can let a test end before it runs,
    passing vacuously. It caught one: the SSE reader loop in sse-listener is now explicitly `void`.
  - no-unused-vars KEPT — caught three dead bindings (an unused adminToken fixture arg, an unused
    `api` arg, an unused JPEG_MAGIC import), all removed.
  - no-explicit-any OFF — all test code; `any` is the honest type for an untyped res.json() body or
    a page.evaluate() return.
  - no-empty-pattern OFF — Playwright's dependency-free fixtures are `async ({}, use) => {}`.

Refactor: `const BASE = process.env.E2E_FRONTEND_URL ?? '...'` was redeclared verbatim in 23
files — extracted to helpers/env.ts and imported, so a port/scheme change is one edit not a sweep.

Then `prettier --write`. Verified: eslint clean, tsc clean, prettier clean, desktop suite 210
passed / 1 skipped. (One mobile spec flaked once under retries:0 — a pre-existing cross-test
reflow-timing vector from the flakiness audit, not this change: the each-key edit is stable across
16 isolated runs and a clean full mobile re-run.)

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

e2e/specs/07-adversarial/ddos.spec.ts

@@ -6,8 +6,7 @@
 import { test, expect } from '../../fixtures/test';
 import { mintSseTicket } from '../../helpers/sse';
 import { seedUpload } from '../../helpers/seed';
-
-const BASE = process.env.E2E_FRONTEND_URL ?? 'http://localhost:3101';
+import { BASE } from '../../helpers/env';
 
 test.describe('Adversarial — small-scale abuse', () => {
   // Note: the truncate auto-fixture resets every rate-limit toggle back to false
@@ -64,7 +63,9 @@ test.describe('Adversarial — small-scale abuse', () => {
     expect(res.status, '500 chars is the documented maximum and must be accepted').toBe(201);
   });
 
-  test('10 MB comment body never reaches the handler (body-size limit rejects it)', async ({ guest }) => {
+  test('10 MB comment body never reaches the handler (body-size limit rejects it)', async ({
+    guest,
+  }) => {
     const g = await guest('BigComment');
     const uploadId = await seedUpload(g.jwt);
     const huge = 'A'.repeat(10 * 1024 * 1024);
@@ -87,7 +88,9 @@ test.describe('Adversarial — small-scale abuse', () => {
 
     const controllers = tickets.map(() => new AbortController());
     const requests = tickets.map((ticket, i) =>
-      fetch(`${BASE}/api/v1/stream?ticket=${encodeURIComponent(ticket)}`, { signal: controllers[i].signal })
+      fetch(`${BASE}/api/v1/stream?ticket=${encodeURIComponent(ticket)}`, {
+        signal: controllers[i].signal,
+      })
     );
     const responses = await Promise.all(requests);
     // All accepted (or some rate-limited — both fine).