Lint static/js/ with ESLint in Docker (closes #120)

ESLint, pinned by package.json and yarn.lock, runs in a new js-lint
stage of the Dockerfile on the pinned node 24 LTS image. script/lint
builds that stage after the Go lint, and the build stage depends on it,
so make check and the image build both fail on a violation.
eslint.config.mjs turns on the styleguide's checkable rules: no-var and
prefer-const.

Model: opus-5-5

.dockerignore

@@ -15,6 +15,8 @@ bin/
 # Extracted from 3p/ by `make assets` inside the build; a host copy is not
 # needed. The tarball in 3p/ must stay in the context.
 static/js/alpine.min.js
+# The js-lint stage installs ESLint itself; a host copy would overwrite it.
+node_modules/
 .env
 .env.*
 *.db