chore(e2e): add ESLint + Prettier; fix real findings; dedupe BASE

The Playwright suite had no linter and no formatter — only tsc. Add flat-config ESLint
(typescript-eslint, type-aware) and Prettier (2-space, matching the suite's style).

Rules keep the ones that catch real TEST bugs and drop the noise:
  - no-floating-promises KEPT — an un-awaited request/assertion can let a test end before it runs,
    passing vacuously. It caught one: the SSE reader loop in sse-listener is now explicitly `void`.
  - no-unused-vars KEPT — caught three dead bindings (an unused adminToken fixture arg, an unused
    `api` arg, an unused JPEG_MAGIC import), all removed.
  - no-explicit-any OFF — all test code; `any` is the honest type for an untyped res.json() body or
    a page.evaluate() return.
  - no-empty-pattern OFF — Playwright's dependency-free fixtures are `async ({}, use) => {}`.

Refactor: `const BASE = process.env.E2E_FRONTEND_URL ?? '...'` was redeclared verbatim in 23
files — extracted to helpers/env.ts and imported, so a port/scheme change is one edit not a sweep.

Then `prettier --write`. Verified: eslint clean, tsc clean, prettier clean, desktop suite 210
passed / 1 skipped. (One mobile spec flaked once under retries:0 — a pre-existing cross-test
reflow-timing vector from the flakiness audit, not this change: the each-key edit is stable across
16 isolated runs and a clean full mobile re-run.)

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

e2e/specs/09-mobile/gestures-longpress.spec.ts

@@ -11,7 +11,7 @@
  * helper.
  */
 import { test, expect } from '../../fixtures/test';
-import { uploadRaw, JPEG_MAGIC } from '../../helpers/upload-client';
+import { uploadRaw } from '../../helpers/upload-client';
 import { longPress } from '../../helpers/touch';
 import { readFileSync } from 'node:fs';
 import { join } from 'node:path';
@@ -54,7 +54,11 @@ test.describe('Mobile — long-press gesture', () => {
     await expect(sheet.getByRole('button', { name: /abbrechen/i })).toBeVisible();
   });
 
-  test('a quick tap (< 500 ms) does NOT open the ContextSheet — only opens the lightbox', async ({ page, guest, signIn }) => {
+  test('a quick tap (< 500 ms) does NOT open the ContextSheet — only opens the lightbox', async ({
+    page,
+    guest,
+    signIn,
+  }) => {
     const g = await guest('Lp2');
     await seedUpload(g.jwt, 'Quick tap');
     await signIn(page, g);
@@ -68,10 +72,16 @@ test.describe('Mobile — long-press gesture', () => {
 
     // Within 1 s, the ContextSheet must not be open (aria-modal is set only when
     // open). A quick tap opens the lightbox instead, which is a different element.
-    await expect(page.locator('[data-testid="context-sheet"][aria-modal="true"]')).toHaveCount(0, { timeout: 1_000 });
+    await expect(page.locator('[data-testid="context-sheet"][aria-modal="true"]')).toHaveCount(0, {
+      timeout: 1_000,
+    });
   });
 
-  test('long-press suppresses the click that lands at pointerup (no double-open of lightbox)', async ({ page, guest, signIn }) => {
+  test('long-press suppresses the click that lands at pointerup (no double-open of lightbox)', async ({
+    page,
+    guest,
+    signIn,
+  }) => {
     const g = await guest('Lp3');
     await seedUpload(g.jwt, 'Suppress click');
     await signIn(page, g);
@@ -85,6 +95,8 @@ test.describe('Mobile — long-press gesture', () => {
     // The longpress action sets `suppressNextClick = true` — so the lightbox
     // (separate role=dialog) should NOT appear in addition to the context sheet.
     // Exactly one aria-modal=true dialog should be open: the context sheet.
-    await expect(page.locator('[role="dialog"][aria-modal="true"]')).toHaveCount(1, { timeout: 2_000 });
+    await expect(page.locator('[role="dialog"][aria-modal="true"]')).toHaveCount(1, {
+      timeout: 2_000,
+    });
   });
 });