Lint static/js/ with ESLint in Docker (closes #120)

ESLint, pinned by package.json and yarn.lock, runs in a new js-lint
stage of the Dockerfile on the pinned node 24 LTS image. script/lint
builds that stage after the Go lint, and the build stage depends on it,
so make check and the image build both fail on a violation.
eslint.config.mjs turns on the styleguide's checkable rules: no-var and
prefer-const.

Model: opus-5-5

.gitea/workflows/check.yml

@@ -33,5 +33,5 @@ jobs:
         # and built cannot report success from cache.
         run: git rev-parse HEAD > .ci-fingerprint
 
-      - name: Build Docker image (runs make fmt-check, golangci-lint, the stylesheet check, make test, make build)
+      - name: Build Docker image (runs make fmt-check, golangci-lint, the stylesheet check, ESLint, make test, make build)
         run: script/cibuild