Lint the frontend with eslint in its own Docker stage (closes #47)

script/lint ran prettier --check, the same check script/fmt-check
runs, so the JavaScript had no linter. eslint now runs with its
recommended rules, set in eslint.config.js, in a new frontend-lint
stage of Dockerfile built from the pinned node image and the lockfile.
The frontend stage copies a file from it, as the builder stage does
from the Go lint stage, so the image cannot build unless eslint passed.
script/lint builds both lint stages with --no-cache and runs no linter
on the host; script/fmt-check keeps prettier on the host, and
script/frontend-check drops its lint step. The viewport harness fixes
the two kinds of finding eslint made. bootstrap wants node 22.13.0, as
eslint 10 does. Also covers item 2 of
#28.

Model: opus-5-5

TODO.md

@@ -23,6 +23,15 @@ latest run passes.
 
 # Completed Steps
 
+- 2026-10-03: the frontend has a real linter (issue #47, and item 2 of issue
+  #28): `eslint` with its recommended rules, set in `eslint.config.js`, runs in
+  a new `frontend-lint` stage of `Dockerfile`, which the frontend stage waits
+  on, as the builder stage waits on the Go `lint` stage. `script/lint` builds
+  both stages without the cache and runs no linter on the host.
+  `script/frontend-lint` runs eslint where it used to repeat the prettier check
+  that `script/fmt-check` runs on the host, and `script/frontend-check`, run by
+  the frontend stage, is now the tests and the format check. `script/bootstrap`
+  wants node 22.13.0 or newer, as eslint 10 does
 - 2026-10-03: the tap-target check in `make frontend-viewport-test` expects one
   visible pin button per WAN host row (issue #46), where it expected at least 10
   of the 26, so pin buttons missing from only some rows now fail it. The host