chore(frontend): add ESLint + Prettier; fix real findings; format the tree

The frontend had no JS/TS linter — only svelte-check. Add flat-config ESLint (typescript-eslint
+ eslint-plugin-svelte) and Prettier (tabs/single-quote, matching the existing style).

Rules encode "catch bugs, not enforce taste":
  - svelte/require-each-key KEPT — it is the exact bug class as the feed mis-tap fix. Fixed every
    flagged block: keyed activeFilters, filteredUsers, stagedFiles (by previewUrl), captionTags,
    admin tabs/jobs/users, the export-viewer suggestions/filters/comments, and the static skeleton
    loops.
  - svelte/prefer-svelte-reactivity KEPT — inline-disabled only the verified-safe sites (a local
    freq Map in a $derived.by, throwaway URLSearchParams query builders), with a reason each.
  - svelte/no-navigation-without-resolve OFF — wants resolve() around every goto()/href; taste, not
    a bug, and pure churn.
  - svelte/no-unused-svelte-ignore OFF — those comments are consumed by svelte-check, which ESLint
    can't see, so it wrongly calls them unused; removing them would reintroduce a11y warnings.
  - no-explicit-any OFF for *.test.ts only (partial fixtures legitimately use any).

Real code fixes beyond keys: removed a dead jobLabel(), an unused ViewerComment import and unused
catch binding, an unused scroll-lock arg, and replaced an empty interface with a type alias.

Then `prettier --write` (54 files). Formatting only. Verified: eslint clean, svelte-check 0 errors,
vitest 46 passed, vite build succeeds.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

frontend/src/lib/sse.ts

@@ -113,9 +113,7 @@ export function connectSse(): void {
 		};
 
 		for (const eventName of KNOWN_EVENTS) {
-			eventSource.addEventListener(eventName, (e) =>
-				dispatch(eventName, (e as MessageEvent).data)
-			);
+			eventSource.addEventListener(eventName, (e) => dispatch(eventName, (e as MessageEvent).data));
 		}
 
 		// `resync` is emitted by the server when our broadcast subscription fell
@@ -201,9 +199,7 @@ function extractCreatedAt(data: string): string | undefined {
  */
 async function deltaFetchAndFan(since: string, attempt = 0): Promise<void> {
 	try {
-		const response = await api.get<DeltaResponse>(
-			`/feed/delta?since=${encodeURIComponent(since)}`
-		);
+		const response = await api.get<DeltaResponse>(`/feed/delta?since=${encodeURIComponent(since)}`);
 		// Advance the cursor to the server clock this delta was computed at, so the next
 		// reconnect resumes exactly where the server left off (no browser-clock skew).
 		lastEventTime = response.server_time;