Lint static/js/ with ESLint in Docker (closes #120)

`REPO_POLICIES.md` binds the repo to a JavaScript styleguide, but nothing checked `static/js/`. ESLint, pinned by `package.json` and `yarn.lock`, now lints it with the styleguide's two checkable rules, `no-var` and `prefer-const`. It runs only in Docker on a digest-pinned node image: a `js-deps` stage installs ESLint and stays cached until the manifests change, and a `js-lint` stage runs it. `script/lint` builds `js-lint`, so `make lint` and `make check` fail on a violation, and the image build depends on it as on the repo's other checks. ESLint, node and yarn are not prerequisites, and `make lint` never uses a host copy.

Model: opus-5-5

Dockerfile

@@ -65,15 +65,31 @@ RUN sed 's/}/}\n/g' static/css/tailwind.css > /tmp/committed.css \
         exit 1; \
     }
 
+# JavaScript lint stages: ESLint, at the version package.json and yarn.lock
+# pin, checks static/js/ against eslint.config.mjs. js-deps installs it and
+# stays cached until those two files change. script/lint forces only js-lint
+# to re-run, and the build stage below runs it too. COPY . . brings in the CI
+# cache barrier described in the lint stage above.
+# node:24.21.0-alpine (LTS, with yarn 1.22.22), 2026-09-18
+FROM node:24.21.0-alpine@sha256:ebfe2f90462722a7a4de65e91990e97fe0d401c70e0e762c5b53302f905ec1c1 AS js-deps
+WORKDIR /src
+COPY package.json yarn.lock ./
+RUN yarn install --frozen-lockfile --ignore-scripts
+
+FROM js-deps AS js-lint
+COPY . .
+RUN --network=none node_modules/.bin/eslint static/js
+
 # Build stage
 # golang:1.26.1-bookworm (Debian-based), 2026-03-17
 # Using Debian-based image because gorm.io/driver/sqlite pulls in
 # mattn/go-sqlite3 (CGO), which does not compile on Alpine musl.
 FROM golang:1.26.1-bookworm@sha256:4465644228bc2857a954b092167e12aa59c006a3492282a6c820bf4755fd64a4 AS builder
 
-# Depend on the lint and stylesheet check stages passing
+# Depend on the lint, stylesheet check and JavaScript lint stages passing
 COPY --from=lint /src/go.sum /dev/null
 COPY --from=css-check /out/tailwind.css /dev/null
+COPY --from=js-lint /src/yarn.lock /dev/null
 
 # jq is a runtime dependency of script/ci-mark-superseded, which the test
 # suite executes. git is what script/version derives the version with.