chore(e2e): add ESLint + Prettier; fix real findings; dedupe BASE

The Playwright suite had no linter and no formatter — only tsc. Add flat-config ESLint
(typescript-eslint, type-aware) and Prettier (2-space, matching the suite's style).

Rules keep the ones that catch real TEST bugs and drop the noise:
  - no-floating-promises KEPT — an un-awaited request/assertion can let a test end before it runs,
    passing vacuously. It caught one: the SSE reader loop in sse-listener is now explicitly `void`.
  - no-unused-vars KEPT — caught three dead bindings (an unused adminToken fixture arg, an unused
    `api` arg, an unused JPEG_MAGIC import), all removed.
  - no-explicit-any OFF — all test code; `any` is the honest type for an untyped res.json() body or
    a page.evaluate() return.
  - no-empty-pattern OFF — Playwright's dependency-free fixtures are `async ({}, use) => {}`.

Refactor: `const BASE = process.env.E2E_FRONTEND_URL ?? '...'` was redeclared verbatim in 23
files — extracted to helpers/env.ts and imported, so a port/scheme change is one edit not a sweep.

Then `prettier --write`. Verified: eslint clean, tsc clean, prettier clean, desktop suite 210
passed / 1 skipped. (One mobile spec flaked once under retries:0 — a pre-existing cross-test
reflow-timing vector from the flakiness audit, not this change: the each-key edit is stable across
16 isolated runs and a clean full mobile re-run.)

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

e2e/specs/08-browser-chaos/multi-tab.spec.ts

@@ -6,7 +6,12 @@ import { test, expect } from '../../fixtures/test';
 import { trackStreamOpens } from '../../helpers/sse';
 
 test.describe('Browser chaos — multi-tab', () => {
-  test('same user in two tabs — each tab establishes its own SSE stream', async ({ page, context, guest, signIn }) => {
+  test('same user in two tabs — each tab establishes its own SSE stream', async ({
+    page,
+    context,
+    guest,
+    signIn,
+  }) => {
     const g = await guest('Twin');
 
     // Count each tab's own EventSource open. Asserting *connection establishment* is
@@ -27,7 +32,10 @@ test.describe('Browser chaos — multi-tab', () => {
     await tab2.close();
   });
 
-  test('two different users in separate browser contexts have isolated localStorage', async ({ browser, guest }) => {
+  test('two different users in separate browser contexts have isolated localStorage', async ({
+    browser,
+    guest,
+  }) => {
     const a = await guest('IsoA');
     const b = await guest('IsoB');
 
@@ -37,20 +45,26 @@ test.describe('Browser chaos — multi-tab', () => {
     const pageB = await ctxB.newPage();
 
     await pageA.goto('http://localhost:3101/');
-    await pageA.evaluate(({ jwt, pin, userId, name }) => {
-      localStorage.setItem('eventsnap_jwt', jwt);
-      localStorage.setItem('eventsnap_pin', pin);
-      localStorage.setItem('eventsnap_user_id', userId);
-      localStorage.setItem('eventsnap_display_name', name);
-    }, { jwt: a.jwt, pin: a.pin, userId: a.userId, name: a.displayName });
+    await pageA.evaluate(
+      ({ jwt, pin, userId, name }) => {
+        localStorage.setItem('eventsnap_jwt', jwt);
+        localStorage.setItem('eventsnap_pin', pin);
+        localStorage.setItem('eventsnap_user_id', userId);
+        localStorage.setItem('eventsnap_display_name', name);
+      },
+      { jwt: a.jwt, pin: a.pin, userId: a.userId, name: a.displayName }
+    );
 
     await pageB.goto('http://localhost:3101/');
-    await pageB.evaluate(({ jwt, pin, userId, name }) => {
-      localStorage.setItem('eventsnap_jwt', jwt);
-      localStorage.setItem('eventsnap_pin', pin);
-      localStorage.setItem('eventsnap_user_id', userId);
-      localStorage.setItem('eventsnap_display_name', name);
-    }, { jwt: b.jwt, pin: b.pin, userId: b.userId, name: b.displayName });
+    await pageB.evaluate(
+      ({ jwt, pin, userId, name }) => {
+        localStorage.setItem('eventsnap_jwt', jwt);
+        localStorage.setItem('eventsnap_pin', pin);
+        localStorage.setItem('eventsnap_user_id', userId);
+        localStorage.setItem('eventsnap_display_name', name);
+      },
+      { jwt: b.jwt, pin: b.pin, userId: b.userId, name: b.displayName }
+    );
 
     // Each context sees only its own user.
     const aUid = await pageA.evaluate(() => localStorage.getItem('eventsnap_user_id'));
@@ -63,7 +77,11 @@ test.describe('Browser chaos — multi-tab', () => {
     await ctxB.close();
   });
 
-  test('localStorage is shared across tabs of the same context (real browser behavior)', async ({ context, guest, signIn }) => {
+  test('localStorage is shared across tabs of the same context (real browser behavior)', async ({
+    context,
+    guest,
+    signIn,
+  }) => {
     // Real browsers share localStorage across tabs of the same origin. Tab A's
     // removeItem is instantly visible in tab B's localStorage. The UX gap to
     // document is that tab B's React/Svelte state isn't *re-rendered* until the