ESLint is configured but never actually run in CI — ci.yml only builds and tests

[abayomicornelius]

Where: .github/workflows/ci.yml, test job:

- name: Build
  run: bun run build

- name: Test with coverage
  run: bun run test:coverage

That's the entire job. There is no bun run lint (or eslint src/)
anywhere in ci.yml, or in any other workflow file.

What's wrong: the repo has a real ESLint setup —
eslint.config.mjs (with @typescript-eslint/recommended,
no-explicit-any: "warn", no-unused-vars: "warn"), a lint/lint:fix
script in package.json, and .husky's pre-commit hook runs
lint-staged (prettier --write + eslint --fix on staged *.ts
files) — but pre-commit hooks are opt-in on the contributor's own
machine and are trivially bypassed (git commit --no-verify, a fresh
clone without bun install ever running the prepare script, a
CI-triggered commit, etc.). Nothing server-side ever re-runs it. The two
issues that originally requested ESLint (#20, #21) delivered the
configuration and scripts but the CI enforcement step that would actually
make it matter never landed.

Impact: this is a plausible root cause behind a chunk of the dead-code
findings filed separately in this sweep — unused imports
(runWithCorrelationId/generateCorrelationId,
startSecretRotation/stopSecretRotation), unused constants
(PANEL_LIFESPAN, dependencyCache), and an unused local
(cookieToken in middleware/csrf.ts) — all of which
@typescript-eslint/no-unused-vars is configured to flag, but since
nothing in CI ever runs ESLint (and the rule is only "warn" severity
besides), none of them were ever surfaced by tooling.

Suggested fix: add a lint step to ci.yml's test job (or a
dedicated job) running bun run lint, and consider bumping
no-unused-vars/no-explicit-any to "error" (or running lint with
--max-warnings 0) so warnings actually fail the build once they're
wired into CI.