Lint the frontend with eslint in its own Docker stage (closes #47)

script/lint ran prettier --check, the same check script/fmt-check
runs, so the JavaScript had no linter. eslint now runs with its
recommended rules, set in eslint.config.js, in a new frontend-lint
stage of Dockerfile built from the pinned node image and the lockfile.
The frontend stage copies a file from it, as the builder stage does
from the Go lint stage, so the image cannot build unless eslint passed.
script/lint builds both lint stages with --no-cache and runs no linter
on the host; script/fmt-check keeps prettier on the host, and
script/frontend-check drops its lint step. The viewport harness fixes
the two kinds of finding eslint made. bootstrap wants node 22.13.0, as
eslint 10 does. Also covers item 2 of
#28.

Model: opus-5-5

script/bootstrap

@@ -24,9 +24,9 @@ ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
 # Pinned versions, 2026-07-07
 NODE_VERSION="22.17.0"
 # The oldest node the frontend's dependencies accept: the "engines"
-# field of puppeteer-core 25.5.0, the most demanding of them, asks for
-# 22.12.0 or newer, 2026-09-29. An older installed node is not used.
-NODE_MIN_VERSION="22.12.0"
+# field of eslint 10.12.0, the most demanding of them, asks for 22.13.0
+# or newer, 2026-10-03. An older installed node is not used.
+NODE_MIN_VERSION="22.13.0"
 NVM_VERSION="0.40.3"
 # sha256 of https://github.com/nvm-sh/nvm/archive/refs/tags/v0.40.3.tar.gz
 NVM_SHA256="5f4d6aaa04a177dc93c985e31dbc411ab6b8c6e1e21d8015dbc1372625fcd1d0"
@@ -270,7 +270,7 @@ main() {
 
     if missing docker; then
         echo "bootstrap: docker not found; make lint, and so make check" >&2
-        echo "  and the pre-commit hook, need it to run the Go linter" >&2
+        echo "  and the pre-commit hook, need it to run the linters" >&2
     fi
     if [ -n "$path_hint" ] && [ -d "$BIN_DIR" ]; then
         echo "bootstrap: add $BIN_DIR to the front of your PATH, e.g." >&2