Lint static/js/ with ESLint in Docker (closes #120)

ESLint, pinned by package.json and yarn.lock, runs in a new js-lint
stage of the Dockerfile on the pinned node 24 LTS image. It starts from
a js-deps stage that installs ESLint and stays cached until those two
files change. script/lint builds js-lint after the Go lint, and the
build stage depends on it, so make check and the image build both fail
on a violation. eslint.config.mjs turns on the styleguide's checkable
rules: no-var and prefer-const.

Model: opus-5-5

script/lint

@@ -1,6 +1,8 @@
 #!/bin/sh
-# script/lint: run the linter. golangci-lint is never installed locally: it
-# runs via docker only, one way, everywhere — script/lint builds
+# script/lint: run the linters, golangci-lint over the Go code and then
+# ESLint over static/js/. Neither is ever installed locally.
+#
+# golangci-lint runs via docker only, one way, everywhere — script/lint builds
 # Dockerfile.lint, which COPYs the repo into the pinned golangci-lint image
 # and lints as a build step. This works even when the docker daemon is remote
 # and bind mounts are impossible, and it removes the host linter's shared
@@ -50,6 +52,20 @@ main() {
         echo "  still matches a stage in Dockerfile.lint." >&2
         exit 1
     fi
+
+    # ESLint runs in the Dockerfile's js-lint stage, which the image build
+    # runs too. It prints nothing on a pass, so there is no summary to look
+    # for. Instead the stage is named once, for both flags: --target fails
+    # on a name that matches no stage, so a rename cannot leave
+    # --no-cache-filter silently ignored. The js-deps stage, which installs
+    # ESLint, keeps its cache, so ESLint is not downloaded again.
+    js_stage=js-lint
+    docker build \
+        --target "$js_stage" \
+        --no-cache-filter="$js_stage" \
+        --progress=plain \
+        --output=type=cacheonly \
+        .
 }
 
 main "$@"