tooling: add ESLint 9 flat config and a typecheck script

- eslint.config.mjs: flat config built on eslint-config-next's flat array
  (core-web-vitals + typescript + Next plugin), with build/generated artifacts
  ignored and the aggressive react-hooks v6 React-Compiler rules downgraded to
  warnings so `pnpm run lint` passes clean (0 errors, 88 warnings of burn-down
  debt) instead of failing. Previously `eslint .` failed outright — no config
  and no eslint binary were installed.
- Install eslint, @eslint/js, eslint-config-next, typescript-eslint, globals as
  devDeps (dev-only; prod Docker build is unaffected).
- package.json: add `typecheck` (tsc --noEmit) and `test:run` scripts.
- app/not-found.tsx: escape apostrophes (react/no-unescaped-entities).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

eslint.config.mjs

@@ -0,0 +1,59 @@
+// ESLint 9 flat config. `eslint-config-next` ships a flat-config array
+// (core-web-vitals + typescript rules + the Next plugin), which we spread and
+// then tune. Run with `pnpm run lint`.
+import next from 'eslint-config-next'
+import tseslint from 'typescript-eslint'
+
+export default [
+  {
+    // Build output, deps, generated artifacts, and non-source assets. Keeping
+    // the generated Supabase types out of lint is deliberate: it is a codegen
+    // artifact (see the banner in types/database.ts), not hand-authored source.
+    ignores: [
+      '.next/**',
+      'node_modules/**',
+      'dist/**',
+      'build/**',
+      'coverage/**',
+      'next-env.d.ts',
+      'types/database.ts',
+      'public/**',
+      'scripts/**',
+      'e2e/**',
+      'playwright-report/**',
+      'test-results/**',
+    ],
+  },
+
+  ...next,
+
+  {
+    // Register the TS plugin in the same object the rule overrides live in
+    // (flat-config requirement) so these tunings apply on top of ...next.
+    plugins: { '@typescript-eslint': tseslint.plugin },
+    rules: {
+      // Unused vars are worth surfacing but should not fail CI on a leading-
+      // underscore throwaway (destructured rest, intentionally-ignored args).
+      '@typescript-eslint/no-unused-vars': [
+        'warn',
+        { argsIgnorePattern: '^_', varsIgnorePattern: '^_', ignoreRestSiblings: true },
+      ],
+      // `any` is discouraged but still present in a few typed-boundary spots
+      // (documented Supabase client seams). Warn so it is visible without
+      // blocking, and drive the count down over time rather than all at once.
+      '@typescript-eslint/no-explicit-any': 'warn',
+
+      // eslint-config-next@16 turns on eslint-plugin-react-hooks v6's new
+      // React-Compiler rule set as errors. They surface genuine modernization
+      // debt (e.g. `static-components` catches the members-client field-in-
+      // render remount bug, fixed during the members refactor), but most flag
+      // patterns that are correct today (data-loading setState in an effect).
+      // Keep them as visible warnings rather than CI-blocking errors and burn
+      // them down incrementally.
+      'react-hooks/set-state-in-effect': 'warn',
+      'react-hooks/static-components': 'warn',
+      'react-hooks/immutability': 'warn',
+      'react-hooks/purity': 'warn',
+    },
+  },
+]