chore(e2e): add ESLint + Prettier; fix real findings; dedupe BASE

The Playwright suite had no linter and no formatter — only tsc. Add flat-config ESLint
(typescript-eslint, type-aware) and Prettier (2-space, matching the suite's style).

Rules keep the ones that catch real TEST bugs and drop the noise:
  - no-floating-promises KEPT — an un-awaited request/assertion can let a test end before it runs,
    passing vacuously. It caught one: the SSE reader loop in sse-listener is now explicitly `void`.
  - no-unused-vars KEPT — caught three dead bindings (an unused adminToken fixture arg, an unused
    `api` arg, an unused JPEG_MAGIC import), all removed.
  - no-explicit-any OFF — all test code; `any` is the honest type for an untyped res.json() body or
    a page.evaluate() return.
  - no-empty-pattern OFF — Playwright's dependency-free fixtures are `async ({}, use) => {}`.

Refactor: `const BASE = process.env.E2E_FRONTEND_URL ?? '...'` was redeclared verbatim in 23
files — extracted to helpers/env.ts and imported, so a port/scheme change is one edit not a sweep.

Then `prettier --write`. Verified: eslint clean, tsc clean, prettier clean, desktop suite 210
passed / 1 skipped. (One mobile spec flaked once under retries:0 — a pre-existing cross-test
reflow-timing vector from the flakiness audit, not this change: the each-key edit is stable across
16 isolated runs and a clean full mobile re-run.)

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

e2e/specs/08-browser-chaos/environment.spec.ts

@@ -16,7 +16,11 @@ test.describe('Browser chaos — environment', () => {
     await ctx.close();
   });
 
-  test('localStorage quota exhausted — writing JWT does not crash the app', async ({ page, guest, signIn }) => {
+  test('localStorage quota exhausted — writing JWT does not crash the app', async ({
+    page,
+    guest,
+    signIn,
+  }) => {
     const g = await guest('QuotaFull');
 
     // Pre-fill localStorage with junk to push us near the quota.
@@ -46,7 +50,11 @@ test.describe('Browser chaos — environment', () => {
     expect(errors.filter((e) => !/storage|quota/i.test(e.message))).toHaveLength(0);
   });
 
-  test('hostile extension simulation: CSS hiding bottom nav does not break navigation', async ({ page, guest, signIn }) => {
+  test('hostile extension simulation: CSS hiding bottom nav does not break navigation', async ({
+    page,
+    guest,
+    signIn,
+  }) => {
     const g = await guest('HostileCss');
     await signIn(page, g);
     await page.goto('/feed');
@@ -59,7 +67,11 @@ test.describe('Browser chaos — environment', () => {
     await expect(page).toHaveURL(/\/account$/);
   });
 
-  test('clock skew: browser ahead by 1 hour — JWT still valid (no nbf claim)', async ({ page, guest, signIn }) => {
+  test('clock skew: browser ahead by 1 hour — JWT still valid (no nbf claim)', async ({
+    page,
+    guest,
+    signIn,
+  }) => {
     const g = await guest('ClockSkew');
 
     // Override Date.now() to be 1h in the future BEFORE the JWT check.
@@ -74,7 +86,11 @@ test.describe('Browser chaos — environment', () => {
     await expect(page.getByRole('link', { name: 'Galerie' })).toBeVisible();
   });
 
-  test('clock skew: browser behind by 2 days — JWT exp may be in the past, app handles 401', async ({ page, guest, signIn }) => {
+  test('clock skew: browser behind by 2 days — JWT exp may be in the past, app handles 401', async ({
+    page,
+    guest,
+    signIn,
+  }) => {
     const g = await guest('ClockBack');
 
     await page.addInitScript(() => {