Lint static/js/ with ESLint in Docker (closes #120)

ESLint, pinned by package.json and yarn.lock, runs in a new js-lint
stage of the Dockerfile on the pinned node 24 LTS image. script/lint
builds that stage after the Go lint, and the build stage depends on it,
so make check and the image build both fail on a violation.
eslint.config.mjs turns on the styleguide's checkable rules: no-var and
prefer-const.

Model: opus-5-5

script/bootstrap

@@ -3,8 +3,8 @@
 # this repo. Idempotent: every install is guarded by a check so already
 # installed tools are skipped. Base tooling comes from nix, apt, brew,
 # or apk (detected in that order); assumes NOTHING is present (not git,
-# make, or go). golangci-lint is deliberately not installed: linting runs
-# only in docker, via script/lint and Dockerfile.lint.
+# make, or go). golangci-lint, node and ESLint are deliberately not
+# installed: linting runs only in docker, via script/lint.
 set -eu
 
 ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"

script/lint

@@ -1,6 +1,8 @@
 #!/bin/sh
-# script/lint: run the linter. golangci-lint is never installed locally: it
-# runs via docker only, one way, everywhere — script/lint builds
+# script/lint: run the linters, golangci-lint over the Go code and then
+# ESLint over static/js/. Neither is ever installed locally.
+#
+# golangci-lint runs via docker only, one way, everywhere — script/lint builds
 # Dockerfile.lint, which COPYs the repo into the pinned golangci-lint image
 # and lints as a build step. This works even when the docker daemon is remote
 # and bind mounts are impossible, and it removes the host linter's shared
@@ -50,6 +52,20 @@ main() {
         echo "  still matches a stage in Dockerfile.lint." >&2
         exit 1
     fi
+
+    # ESLint runs in the Dockerfile's js-lint stage, which the image build
+    # runs too. It prints nothing on a pass, so there is no summary to look
+    # for. Instead the stage is named once, for both flags: --target fails
+    # on a name that matches no stage, so a rename cannot leave
+    # --no-cache-filter silently ignored. That flag re-runs the whole stage,
+    # yarn install included.
+    js_stage=js-lint
+    docker build \
+        --target "$js_stage" \
+        --no-cache-filter="$js_stage" \
+        --progress=plain \
+        --output=type=cacheonly \
+        .
 }
 
 main "$@"