Lint static/js/ with ESLint in Docker (closes #120)

ESLint, pinned by package.json and yarn.lock, runs in a new js-lint
stage of the Dockerfile on the pinned node 24 LTS image. It starts from
a js-deps stage that installs ESLint and stays cached until those two
files change. script/lint builds js-lint after the Go lint, and the
build stage depends on it, so make check and the image build both fail
on a violation. eslint.config.mjs turns on the styleguide's checkable
rules: no-var and prefer-const.

Model: opus-5-5

eslint.config.mjs

@@ -0,0 +1,18 @@
+// ESLint configuration for static/js/. script/lint and the image build run
+// ESLint in the Dockerfile's js-lint stage, never on the host.
+//
+// The rules are the ones the JavaScript styleguide linked from
+// REPO_POLICIES.md states that a linter can check: const for everything,
+// let only for a variable that is reassigned, never var.
+export default [
+    // Alpine.js, extracted from 3p/ by make assets; not ours to lint.
+    { ignores: ["static/js/alpine.min.js"] },
+    {
+        // The pages load static/js/app.js as a classic script, not a module.
+        languageOptions: { sourceType: "script" },
+        rules: {
+            "no-var": "error",
+            "prefer-const": "error",
+        },
+    },
+];