Lint static/js/ with ESLint in Docker (closes #120)

ESLint, pinned by package.json and yarn.lock, runs in a new js-lint
stage of the Dockerfile on the pinned node 24 LTS image. script/lint
builds that stage after the Go lint, and the build stage depends on it,
so make check and the image build both fail on a violation.
eslint.config.mjs turns on the styleguide's checkable rules: no-var and
prefer-const.

Model: opus-5-5

script/bootstrap

@@ -3,8 +3,8 @@
 # this repo. Idempotent: every install is guarded by a check so already
 # installed tools are skipped. Base tooling comes from nix, apt, brew,
 # or apk (detected in that order); assumes NOTHING is present (not git,
-# make, or go). golangci-lint is deliberately not installed: linting runs
-# only in docker, via script/lint and Dockerfile.lint.
+# make, or go). golangci-lint, node and ESLint are deliberately not
+# installed: linting runs only in docker, via script/lint.
 set -eu
 
 ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"