Lint static/js/ with ESLint in Docker (closes #120)

ESLint, pinned by package.json and yarn.lock, runs in a new js-lint
stage of the Dockerfile on the pinned node 24 LTS image. It starts from
a js-deps stage that installs ESLint and stays cached until those two
files change. script/lint builds js-lint after the Go lint, and the
build stage depends on it, so make check and the image build both fail
on a violation. eslint.config.mjs turns on the styleguide's checkable
rules: no-var and prefer-const.

Model: opus-5-5

.gitignore

@@ -15,6 +15,9 @@ bin/
 # Go vendor directory
 vendor/
 
+# ESLint and its dependencies, installed from yarn.lock
+node_modules/
+
 # IDE specific files
 .idea/
 *.swp