chore(e2e): add ESLint + Prettier; fix real findings; dedupe BASE

The Playwright suite had no linter and no formatter — only tsc. Add flat-config ESLint
(typescript-eslint, type-aware) and Prettier (2-space, matching the suite's style).

Rules keep the ones that catch real TEST bugs and drop the noise:
  - no-floating-promises KEPT — an un-awaited request/assertion can let a test end before it runs,
    passing vacuously. It caught one: the SSE reader loop in sse-listener is now explicitly `void`.
  - no-unused-vars KEPT — caught three dead bindings (an unused adminToken fixture arg, an unused
    `api` arg, an unused JPEG_MAGIC import), all removed.
  - no-explicit-any OFF — all test code; `any` is the honest type for an untyped res.json() body or
    a page.evaluate() return.
  - no-empty-pattern OFF — Playwright's dependency-free fixtures are `async ({}, use) => {}`.

Refactor: `const BASE = process.env.E2E_FRONTEND_URL ?? '...'` was redeclared verbatim in 23
files — extracted to helpers/env.ts and imported, so a port/scheme change is one edit not a sweep.

Then `prettier --write`. Verified: eslint clean, tsc clean, prettier clean, desktop suite 210
passed / 1 skipped. (One mobile spec flaked once under retries:0 — a pre-existing cross-test
reflow-timing vector from the flakiness audit, not this change: the each-key edit is stable across
16 isolated runs and a clean full mobile re-run.)

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

e2e/specs/10-flow-review/ban-replay.spec.ts

@@ -10,8 +10,7 @@
  */
 import { test, expect } from '../../fixtures/test';
 import { seedUpload } from '../../helpers/seed';
-
-const BASE = process.env.E2E_FRONTEND_URL ?? 'http://localhost:3101';
+import { BASE } from '../../helpers/env';
 
 async function feedDelta(jwt: string, since: string): Promise<any> {
   const res = await fetch(`${BASE}/api/v1/feed/delta?since=${encodeURIComponent(since)}`, {
@@ -40,9 +39,10 @@ test.describe('Realtime — ban replays in the reconnect delta (H1 audit fix)',
 
     // A delta from the pre-ban cursor MUST surface the ban so the client can evict.
     const afterBan = await feedDelta(host.jwt, cursorBefore);
-    expect(afterBan.hidden_user_ids, 'ban replayed to a client that missed the live event').toContain(
-      g.userId
-    );
+    expect(
+      afterBan.hidden_user_ids,
+      'ban replayed to a client that missed the live event'
+    ).toContain(g.userId);
 
     // And a delta from a cursor AFTER the ban must NOT re-surface it (the `>= since` filter
     // means a client already past the ban isn't told again forever).

e2e/specs/10-flow-review/export-reopen-rerelease.spec.ts

@@ -44,8 +44,8 @@ import { join } from 'node:path';
 import { seedUpload } from '../../helpers/seed';
 import { uploadRaw, uploadPausedMidStream } from '../../helpers/upload-client';
 import { SseListener } from '../../helpers/sse-listener';
+import { BASE } from '../../helpers/env';
 
-const BASE = process.env.E2E_FRONTEND_URL ?? 'http://localhost:3101';
 const SLUG = 'e2e-test-event';
 const N_UPLOADS = 6;
 /** A ZIP holding no entries: just the 22-byte end-of-central-directory record. */
@@ -74,7 +74,9 @@ function post(path: string, jwt: string) {
 }
 
 async function exportStatus(jwt: string): Promise<any> {
-  const res = await fetch(BASE + '/api/v1/export/status', { headers: { Authorization: `Bearer ${jwt}` } });
+  const res = await fetch(BASE + '/api/v1/export/status', {
+    headers: { Authorization: `Bearer ${jwt}` },
+  });
   return res.json();
 }
 
@@ -85,10 +87,13 @@ async function mintTicket(jwt: string): Promise<string> {
 
 async function waitExportDone(jwt: string) {
   await expect
-    .poll(async () => {
-      const s = await exportStatus(jwt);
-      return s.released === true && s.zip?.status === 'done' && s.html?.status === 'done';
-    }, { timeout: 60_000, intervals: [500] })
+    .poll(
+      async () => {
+        const s = await exportStatus(jwt);
+        return s.released === true && s.zip?.status === 'done' && s.html?.status === 'done';
+      },
+      { timeout: 60_000, intervals: [500] }
+    )
     .toBe(true);
 }
 
@@ -151,10 +156,14 @@ test.describe('Flow re-review — reopen→re-release export integrity + stale-k
     expect((await post('/api/v1/host/gallery/release', host.jwt)).status).toBe(204);
 
     // Post-release uploads must be rejected (belt-and-suspenders on top of the lock).
-    const rejected = await uploadRaw(host.jwt, readFileSync(join(process.cwd(), 'fixtures', 'media', 'sample.jpg')), {
-      filename: 'late.jpg',
-      contentType: 'image/jpeg',
-    });
+    const rejected = await uploadRaw(
+      host.jwt,
+      readFileSync(join(process.cwd(), 'fixtures', 'media', 'sample.jpg')),
+      {
+        filename: 'late.jpg',
+        contentType: 'image/jpeg',
+      }
+    );
     expect(rejected.status).toBe(403);
 
     // Churn: reopen (retires the generation) then re-release, several times in quick
@@ -418,7 +427,10 @@ test.describe('Flow re-review — reopen→re-release export integrity + stale-k
       listing.some((n) => n.includes(takedown)),
       'the taken-down photo must be gone from the regenerated keepsake'
     ).toBe(false);
-    expect(listing.some((n) => n.includes(keep)), 'the kept photo survives').toBe(true);
+    expect(
+      listing.some((n) => n.includes(keep)),
+      'the kept photo survives'
+    ).toBe(true);
   });
 
   test('BANNING a guest after release removes their photos from the keepsake', async ({
@@ -451,7 +463,10 @@ test.describe('Flow re-review — reopen→re-release export integrity + stale-k
       listing.some((n) => n.includes(badPhoto)),
       "a banned guest's photo must not survive in the keepsake everyone downloads"
     ).toBe(false);
-    expect(listing.some((n) => n.includes(goodPhoto)), 'everyone else keeps their photos').toBe(true);
+    expect(
+      listing.some((n) => n.includes(goodPhoto)),
+      'everyone else keeps their photos'
+    ).toBe(true);
     expect(listing).toHaveLength(1);
   });
 
@@ -543,7 +558,9 @@ test.describe('Flow re-review — reopen→re-release export integrity + stale-k
     expect(res.status).toBe(200);
 
     // ... and it bumped the epoch (the viewer must rebuild) ...
-    await expect.poll(async () => await eventEpoch(), { timeout: 10_000 }).toBeGreaterThan(eventEpochBefore);
+    await expect
+      .poll(async () => await eventEpoch(), { timeout: 10_000 })
+      .toBeGreaterThan(eventEpochBefore);
 
     // ... while the ZIP was CARRIED FORWARD, not rebuilt: its row rides the new epoch (the media
     // didn't change, so a full ZIP rebuild would be wasted work).
@@ -663,7 +680,9 @@ test.describe('Flow re-review — reopen→re-release export integrity + stale-k
 
     // Stuck: the keepsake is not downloadable and no amount of re-releasing helps.
     const ticket = await mintTicket(host.jwt);
-    expect((await fetch(BASE + '/api/v1/export/zip?ticket=' + encodeURIComponent(ticket))).status).toBe(404);
+    expect(
+      (await fetch(BASE + '/api/v1/export/zip?ticket=' + encodeURIComponent(ticket))).status
+    ).toBe(404);
     // ("Galerie wurde bereits freigegeben." — this is the dead end the rebuild endpoint exists for.)
     expect((await post('/api/v1/host/gallery/release', host.jwt)).status).toBe(400);
 

e2e/specs/10-flow-review/offline-resume.spec.ts

@@ -75,9 +75,7 @@ test.describe('Flow re-review — offline upload auto-resume (B1)', () => {
     // While offline: nothing may have reached the server, and — the crux of the
     // fix — the item must be parked as `pending`, NOT burned to `error`/`blocked`
     // (which on the old code would require a manual retry tap).
-    await expect
-      .poll(() => queueStatuses(page), { timeout: 8_000 })
-      .toEqual(['pending']);
+    await expect.poll(() => queueStatuses(page), { timeout: 8_000 }).toEqual(['pending']);
     expect(await db.countUploadsForUser(g.userId)).toBe(0);
 
     // Reconnect. The `online` listener must resume the queue automatically — we do
@@ -85,16 +83,17 @@ test.describe('Flow re-review — offline upload auto-resume (B1)', () => {
     await page.context().setOffline(false);
 
     // The queued upload is now created server-side without any manual interaction.
-    await expect
-      .poll(() => db.countUploadsForUser(g.userId), { timeout: 20_000 })
-      .toBe(1);
+    await expect.poll(() => db.countUploadsForUser(g.userId), { timeout: 20_000 }).toBe(1);
 
     // And the queue item ends terminal-good (done) or is drained — never stuck in error.
     await expect
-      .poll(async () => {
-        const s = await queueStatuses(page);
-        return s.every((x) => x === 'done') || s.length === 0;
-      }, { timeout: 10_000 })
+      .poll(
+        async () => {
+          const s = await queueStatuses(page);
+          return s.every((x) => x === 'done') || s.length === 0;
+        },
+        { timeout: 10_000 }
+      )
       .toBe(true);
   });
 });

e2e/specs/10-flow-review/upload-lock-code.spec.ts

@@ -9,6 +9,7 @@ import { test, expect } from '../../fixtures/test';
 import { uploadRaw } from '../../helpers/upload-client';
 import { readFileSync } from 'node:fs';
 import { join } from 'node:path';
+import { BASE } from '../../helpers/env';
 
 const SAMPLE = () => readFileSync(join(process.cwd(), 'fixtures', 'media', 'sample.jpg'));
 
@@ -36,7 +37,6 @@ test.describe('Upload — locked event uses a distinct, reversible 403 (audit fi
   });
 
   test('released gallery → 403 uploads_locked (also reversible via reopen)', async ({ host }) => {
-    const BASE = process.env.E2E_FRONTEND_URL ?? 'http://localhost:3101';
     const rel = await fetch(`${BASE}/api/v1/host/gallery/release`, {
       method: 'POST',
       headers: { Authorization: `Bearer ${host.jwt}` },