Adopt ESLint for frontend static analysis

[openidle-dev]

Context

Today the only frontend static-analysis gate is npx tsc --noEmit (per CLAUDE.md). CodeRabbit also flags this on every PR ("ESLint skipped: no ESLint configuration detected").

tsc catches type errors but misses real classes of bugs in a React + Tauri codebase:

• React Hooks violations — missing useEffect deps, conditional hooks, stale closures. eslint-plugin-react-hooks's exhaustive-deps is the highest-value rule here and catches actual runtime bugs tsc cannot see.
• Floating promises — easy to miss in a Tauri app where every IPC call is async. @typescript-eslint/no-floating-promises catches them.
• Contributor PR floor — raises baseline quality without manual nitpicking in review.

Proposal

Minimal flat-config ESLint setup, additive to existing CI.

Scope:

• eslint.config.js (flat config)
• Presets: @eslint/js recommended, typescript-eslint recommended (not recommended-type-checked — too noisy on first run), eslint-plugin-react-hooks, eslint-plugin-react-refresh
• New script: npm run lint
• Wire into .github/workflows/ci.yml alongside tsc --noEmit
• Update CLAUDE.md to reflect ESLint as a gate
• Update CONTRIBUTING.md to mention the lint step

Explicitly out of scope:

• Prettier — separate decision, separate PR
• recommended-type-checked rules — can be enabled later once the codebase is clean against the base ruleset
• Backend (Rust) — cargo clippy -- -D warnings is already wired

Acceptance criteria

• npm run lint passes on main
• CI runs lint on every PR
• No suppressions added to make the initial pass green that don't have a tracking comment or follow-up issue
• CLAUDE.md updated

Notes

Expect a non-trivial first-pass cleanup. If the violation count is large, split into:

1. Land config + CI wiring with whatever minimum suppressions are needed
2. Follow-up PR(s) to remove suppressions