Lint the frontend with eslint in its own Docker stage (closes #47)

script/lint ran prettier --check, the same check script/fmt-check
runs, so the JavaScript had no linter. eslint now runs with its
recommended rules, set in eslint.config.js, in a new frontend-lint
stage of Dockerfile built from the pinned node image and the lockfile.
The frontend stage copies a file from it, as the builder stage does
from the Go lint stage, so the image cannot build unless eslint passed.
script/lint builds both lint stages with --no-cache and runs no linter
on the host; script/fmt-check keeps prettier on the host, and
script/frontend-check drops its lint step. The viewport harness fixes
the two kinds of finding eslint made. bootstrap wants node 22.13.0, as
eslint 10 does. Also covers item 2 of
#28.

Model: opus-5-5

Dockerfile

@@ -59,20 +59,35 @@ RUN version="${VERSION:-$(git --git-dir=/git describe --tags --always)}"; \
     esac; \
     VERSION="$version" make build
 
+# Frontend lint stage — eslint over the JavaScript, as the lint stage
+# above lints the Go. The root make lint builds this stage alone too.
+# node:22-alpine as of 2026-02-22
+FROM node@sha256:e4bf2a82ad0a4037d28035ae71529873c069b13eb0455466ae0bc13363826e34 AS frontend-lint
+WORKDIR /app
+COPY package.json yarn.lock ./
+RUN yarn install --frozen-lockfile
+COPY . .
+RUN script/frontend-lint
+
 # Frontend stage
 # node:22-alpine as of 2026-02-22
 FROM node@sha256:e4bf2a82ad0a4037d28035ae71529873c069b13eb0455466ae0bc13363826e34 AS frontend
 WORKDIR /app
+
+# Force BuildKit to run the frontend-lint stage before proceeding, as
+# the builder stage does with the lint stage: without this no-op copy an
+# eslint failure would not gate the image.
+COPY --from=frontend-lint /app/yarn.lock /dev/null
+
 COPY package.json yarn.lock ./
 RUN yarn install --frozen-lockfile
 RUN apk add --no-cache git make
 COPY . .
-# make frontend-check is the frontend half of make check (test + lint +
-# fmt-check); its test step runs the unit tests, then the production
-# yarn build, so this both produces dist/ and gates the image on
-# lint/fmt-check/test regressions.
-# This node stage has neither Go nor Docker; the lint and builder stages
-# above gate the backend half.
+# make frontend-check runs the frontend tests and format check; its test
+# step runs the unit tests, then the production yarn build, so this both
+# produces dist/ and gates the image on test and formatting regressions.
+# This node stage has neither Go nor Docker; the frontend-lint, lint and
+# builder stages above gate the rest.
 RUN make frontend-check
 
 # Runtime stage