chore(frontend): add ESLint + Prettier; fix real findings; format the tree

The frontend had no JS/TS linter — only svelte-check. Add flat-config ESLint (typescript-eslint
+ eslint-plugin-svelte) and Prettier (tabs/single-quote, matching the existing style).

Rules encode "catch bugs, not enforce taste":
  - svelte/require-each-key KEPT — it is the exact bug class as the feed mis-tap fix. Fixed every
    flagged block: keyed activeFilters, filteredUsers, stagedFiles (by previewUrl), captionTags,
    admin tabs/jobs/users, the export-viewer suggestions/filters/comments, and the static skeleton
    loops.
  - svelte/prefer-svelte-reactivity KEPT — inline-disabled only the verified-safe sites (a local
    freq Map in a $derived.by, throwaway URLSearchParams query builders), with a reason each.
  - svelte/no-navigation-without-resolve OFF — wants resolve() around every goto()/href; taste, not
    a bug, and pure churn.
  - svelte/no-unused-svelte-ignore OFF — those comments are consumed by svelte-check, which ESLint
    can't see, so it wrongly calls them unused; removing them would reintroduce a11y warnings.
  - no-explicit-any OFF for *.test.ts only (partial fixtures legitimately use any).

Real code fixes beyond keys: removed a dead jobLabel(), an unused ViewerComment import and unused
catch binding, an unused scroll-lock arg, and replaced an empty interface with a type alias.

Then `prettier --write` (54 files). Formatting only. Verified: eslint clean, svelte-check 0 errors,
vitest 46 passed, vite build succeeds.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

frontend/src/lib/auth.ts

@@ -65,7 +65,12 @@ export function getExpiry(): Date | null {
 	}
 }
 
-export function setAuth(jwt: string, pin: string | null, userId: string, displayName?: string): void {
+export function setAuth(
+	jwt: string,
+	pin: string | null,
+	userId: string,
+	displayName?: string
+): void {
 	if (!browser) return;
 	// DISPLACE any resident admin session: reads are sessionStorage-first, so a leftover
 	// admin token there would otherwise shadow this guest login and hand the guest admin
@@ -130,7 +135,11 @@ export function clearAuth(): void {
 	// if you ever need ordering, introduce a priority field rather than relying
 	// on import-load timing, which is fragile across refactors.
 	for (const fn of clearAuthHooks) {
-		try { fn(); } catch { /* hook failure is non-fatal */ }
+		try {
+			fn();
+		} catch {
+			/* hook failure is non-fatal */
+		}
 	}
 }