Lint static/js/ with ESLint in Docker (closes #120)

ESLint, pinned by package.json and yarn.lock, runs in a new js-lint
stage of the Dockerfile on the pinned node 24 LTS image. It starts from
a js-deps stage that installs ESLint and stays cached until those two
files change. script/lint builds js-lint after the Go lint, and the
build stage depends on it, so make check and the image build both fail
on a violation. eslint.config.mjs turns on the styleguide's checkable
rules: no-var and prefer-const.

Model: opus-5-5

Dockerfile

@@ -65,15 +65,31 @@ RUN sed 's/}/}\n/g' static/css/tailwind.css > /tmp/committed.css \
         exit 1; \
     }
 
+# JavaScript lint stages: ESLint, at the version package.json and yarn.lock
+# pin, checks static/js/ against eslint.config.mjs. js-deps installs it and
+# stays cached until those two files change. script/lint forces only js-lint
+# to re-run, and the build stage below runs it too. COPY . . brings in the CI
+# cache barrier described in the lint stage above.
+# node:24.21.0-alpine (LTS, with yarn 1.22.22), 2026-09-18
+FROM node:24.21.0-alpine@sha256:ebfe2f90462722a7a4de65e91990e97fe0d401c70e0e762c5b53302f905ec1c1 AS js-deps
+WORKDIR /src
+COPY package.json yarn.lock ./
+RUN yarn install --frozen-lockfile --ignore-scripts
+
+FROM js-deps AS js-lint
+COPY . .
+RUN --network=none node_modules/.bin/eslint static/js
+
 # Build stage
 # golang:1.26.1-bookworm (Debian-based), 2026-03-17
 # Using Debian-based image because gorm.io/driver/sqlite pulls in
 # mattn/go-sqlite3 (CGO), which does not compile on Alpine musl.
 FROM golang:1.26.1-bookworm@sha256:4465644228bc2857a954b092167e12aa59c006a3492282a6c820bf4755fd64a4 AS builder
 
-# Depend on the lint and stylesheet check stages passing
+# Depend on the lint, stylesheet check and JavaScript lint stages passing
 COPY --from=lint /src/go.sum /dev/null
 COPY --from=css-check /out/tailwind.css /dev/null
+COPY --from=js-lint /src/yarn.lock /dev/null
 
 # jq is a runtime dependency of script/ci-mark-superseded, which the test
 # suite executes. git is what script/version derives the version with.