Lint static/js/ with ESLint in Docker (closes #120)

ESLint, pinned by package.json and yarn.lock, runs in a new js-lint
stage of the Dockerfile on the pinned node 24 LTS image. script/lint
builds that stage after the Go lint, and the build stage depends on it,
so make check and the image build both fail on a violation.
eslint.config.mjs turns on the styleguide's checkable rules: no-var and
prefer-const.

Model: opus-5-5

Dockerfile

@@ -65,15 +65,28 @@ RUN sed 's/}/}\n/g' static/css/tailwind.css > /tmp/committed.css \
         exit 1; \
     }
 
+# JavaScript lint stage: ESLint, at the version package.json and yarn.lock
+# pin, checks static/js/ against eslint.config.mjs. script/lint runs this
+# stage, and so does the build stage below. COPY . . brings in the CI cache
+# barrier described in the lint stage above.
+# node:24.21.0-alpine (LTS, with yarn 1.22.22), 2026-09-18
+FROM node:24.21.0-alpine@sha256:ebfe2f90462722a7a4de65e91990e97fe0d401c70e0e762c5b53302f905ec1c1 AS js-lint
+WORKDIR /src
+COPY package.json yarn.lock ./
+RUN yarn install --frozen-lockfile --ignore-scripts
+COPY . .
+RUN --network=none node_modules/.bin/eslint static/js
+
 # Build stage
 # golang:1.26.1-bookworm (Debian-based), 2026-03-17
 # Using Debian-based image because gorm.io/driver/sqlite pulls in
 # mattn/go-sqlite3 (CGO), which does not compile on Alpine musl.
 FROM golang:1.26.1-bookworm@sha256:4465644228bc2857a954b092167e12aa59c006a3492282a6c820bf4755fd64a4 AS builder
 
-# Depend on the lint and stylesheet check stages passing
+# Depend on the lint, stylesheet check and JavaScript lint stages passing
 COPY --from=lint /src/go.sum /dev/null
 COPY --from=css-check /out/tailwind.css /dev/null
+COPY --from=js-lint /src/yarn.lock /dev/null
 
 # jq is a runtime dependency of script/ci-mark-superseded, which the test
 # suite executes. git is what script/version derives the version with.