chore(e2e): add ESLint + Prettier; fix real findings; dedupe BASE

The Playwright suite had no linter and no formatter — only tsc. Add flat-config ESLint
(typescript-eslint, type-aware) and Prettier (2-space, matching the suite's style).

Rules keep the ones that catch real TEST bugs and drop the noise:
  - no-floating-promises KEPT — an un-awaited request/assertion can let a test end before it runs,
    passing vacuously. It caught one: the SSE reader loop in sse-listener is now explicitly `void`.
  - no-unused-vars KEPT — caught three dead bindings (an unused adminToken fixture arg, an unused
    `api` arg, an unused JPEG_MAGIC import), all removed.
  - no-explicit-any OFF — all test code; `any` is the honest type for an untyped res.json() body or
    a page.evaluate() return.
  - no-empty-pattern OFF — Playwright's dependency-free fixtures are `async ({}, use) => {}`.

Refactor: `const BASE = process.env.E2E_FRONTEND_URL ?? '...'` was redeclared verbatim in 23
files — extracted to helpers/env.ts and imported, so a port/scheme change is one edit not a sweep.

Then `prettier --write`. Verified: eslint clean, tsc clean, prettier clean, desktop suite 210
passed / 1 skipped. (One mobile spec flaked once under retries:0 — a pre-existing cross-test
reflow-timing vector from the flakiness audit, not this change: the each-key edit is stable across
16 isolated runs and a clean full mobile re-run.)

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

e2e/specs/10-flow-review/export-reopen-rerelease.spec.ts

@@ -44,8 +44,8 @@ import { join } from 'node:path';
 import { seedUpload } from '../../helpers/seed';
 import { uploadRaw, uploadPausedMidStream } from '../../helpers/upload-client';
 import { SseListener } from '../../helpers/sse-listener';
+import { BASE } from '../../helpers/env';
 
-const BASE = process.env.E2E_FRONTEND_URL ?? 'http://localhost:3101';
 const SLUG = 'e2e-test-event';
 const N_UPLOADS = 6;
 /** A ZIP holding no entries: just the 22-byte end-of-central-directory record. */
@@ -74,7 +74,9 @@ function post(path: string, jwt: string) {
 }
 
 async function exportStatus(jwt: string): Promise<any> {
-  const res = await fetch(BASE + '/api/v1/export/status', { headers: { Authorization: `Bearer ${jwt}` } });
+  const res = await fetch(BASE + '/api/v1/export/status', {
+    headers: { Authorization: `Bearer ${jwt}` },
+  });
   return res.json();
 }
 
@@ -85,10 +87,13 @@ async function mintTicket(jwt: string): Promise<string> {
 
 async function waitExportDone(jwt: string) {
   await expect
-    .poll(async () => {
-      const s = await exportStatus(jwt);
-      return s.released === true && s.zip?.status === 'done' && s.html?.status === 'done';
-    }, { timeout: 60_000, intervals: [500] })
+    .poll(
+      async () => {
+        const s = await exportStatus(jwt);
+        return s.released === true && s.zip?.status === 'done' && s.html?.status === 'done';
+      },
+      { timeout: 60_000, intervals: [500] }
+    )
     .toBe(true);
 }
 
@@ -151,10 +156,14 @@ test.describe('Flow re-review — reopen→re-release export integrity + stale-k
     expect((await post('/api/v1/host/gallery/release', host.jwt)).status).toBe(204);
 
     // Post-release uploads must be rejected (belt-and-suspenders on top of the lock).
-    const rejected = await uploadRaw(host.jwt, readFileSync(join(process.cwd(), 'fixtures', 'media', 'sample.jpg')), {
-      filename: 'late.jpg',
-      contentType: 'image/jpeg',
-    });
+    const rejected = await uploadRaw(
+      host.jwt,
+      readFileSync(join(process.cwd(), 'fixtures', 'media', 'sample.jpg')),
+      {
+        filename: 'late.jpg',
+        contentType: 'image/jpeg',
+      }
+    );
     expect(rejected.status).toBe(403);
 
     // Churn: reopen (retires the generation) then re-release, several times in quick
@@ -418,7 +427,10 @@ test.describe('Flow re-review — reopen→re-release export integrity + stale-k
       listing.some((n) => n.includes(takedown)),
       'the taken-down photo must be gone from the regenerated keepsake'
     ).toBe(false);
-    expect(listing.some((n) => n.includes(keep)), 'the kept photo survives').toBe(true);
+    expect(
+      listing.some((n) => n.includes(keep)),
+      'the kept photo survives'
+    ).toBe(true);
   });
 
   test('BANNING a guest after release removes their photos from the keepsake', async ({
@@ -451,7 +463,10 @@ test.describe('Flow re-review — reopen→re-release export integrity + stale-k
       listing.some((n) => n.includes(badPhoto)),
       "a banned guest's photo must not survive in the keepsake everyone downloads"
     ).toBe(false);
-    expect(listing.some((n) => n.includes(goodPhoto)), 'everyone else keeps their photos').toBe(true);
+    expect(
+      listing.some((n) => n.includes(goodPhoto)),
+      'everyone else keeps their photos'
+    ).toBe(true);
     expect(listing).toHaveLength(1);
   });
 
@@ -543,7 +558,9 @@ test.describe('Flow re-review — reopen→re-release export integrity + stale-k
     expect(res.status).toBe(200);
 
     // ... and it bumped the epoch (the viewer must rebuild) ...
-    await expect.poll(async () => await eventEpoch(), { timeout: 10_000 }).toBeGreaterThan(eventEpochBefore);
+    await expect
+      .poll(async () => await eventEpoch(), { timeout: 10_000 })
+      .toBeGreaterThan(eventEpochBefore);
 
     // ... while the ZIP was CARRIED FORWARD, not rebuilt: its row rides the new epoch (the media
     // didn't change, so a full ZIP rebuild would be wasted work).
@@ -663,7 +680,9 @@ test.describe('Flow re-review — reopen→re-release export integrity + stale-k
 
     // Stuck: the keepsake is not downloadable and no amount of re-releasing helps.
     const ticket = await mintTicket(host.jwt);
-    expect((await fetch(BASE + '/api/v1/export/zip?ticket=' + encodeURIComponent(ticket))).status).toBe(404);
+    expect(
+      (await fetch(BASE + '/api/v1/export/zip?ticket=' + encodeURIComponent(ticket))).status
+    ).toBe(404);
     // ("Galerie wurde bereits freigegeben." — this is the dead end the rebuild endpoint exists for.)
     expect((await post('/api/v1/host/gallery/release', host.jwt)).status).toBe(400);