Restore working lint setup and fix Playwright cold-start flake

[taurheim]

Fixes the two pre-existing issues called out in #70.

1. npm run lint was broken

It failed with command "lint" does not exist - the script survived but the eslint plugin and config were never committed. The eslint-disable comments in src/ (no-console, no-await-in-loop, no-unused-expressions) show the code was written against the Vue CLI airbnb preset, so this restores exactly that toolchain.

That surfaced 4324 problems. ~4000 were linebreak-style objecting that a Windows checkout is CRLF - unwinnable cross-platform once git normalizes EOLs, so that rule is off. Of the 356 real ones, --fix handled 98 (formatting only, no semantics).

The remainder split two ways.

Rules turned off because they fight deliberate patterns (each commented in .eslintrc.js):

• no-underscore-dangle - Vue 2 skips reactivity for keys starting with _, which is how SelectStep holds large track arrays cheaply. Renaming those fields would silently make them reactive and tank performance on big histories. This one is load-bearing.
• no-await-in-loop - scrobbling is sequential on purpose; Last.fm rate-limits and each request must settle before the next.
• no-promise-executor-return - the new Promise((r) => setTimeout(r, ms)) sleep idiom used for backoff.
• no-plusplus, no-continue, class-methods-use-this, for-of.
• no-useless-constructor swapped for the TS-aware version, which understands parameter properties instead of flagging them as empty.

Genuine defects, fixed:

• LastFm.makeRequest wrote api_key/sk/api_sig back into the caller''s params object; it now signs a copy. It also fell out of the retry loop returning undefined instead of throwing.
• Parenthesised three a * b / c expressions.
• Removed the dead empty postScrobble and Home.vue''s unused component registration; fixed an import carrying a .ts extension.
• The accessibility findings were real, so they''re fixed rather than silenced: alt text on both images, keyboard access (role/tabindex/keydown) for the drop zone and the "Not you?" control, and aria-labels on the visually hidden file inputs.

Lint reports 0 errors (82 warnings, mostly no-explicit-any, which don''t fail the build) and now runs in CI as lint:check - --no-fix, so the auto-fixer can''t let CI pass silently.

2. Playwright cold-start flake

webServer waited on the TCP port, but vue-cli-service accepts connections before webpack''s first compile finishes. Tests started against a still-building server, and the first navigation absorbed the ~29s compile inside its own 30s timeout - so Home Page > renders home page with instructions failed on cold starts.

It now waits on a URL, keeping that wait inside the webServer timeout. The URL has to be the publicPath (/scrobblify/): / only resolves via the dev server''s history fallback for browser requests and 404s otherwise, which I confirmed by probing both. That test now takes 5.4s.

Testing

• npm run lint:check - 0 errors, exit 0
• npm run build - clean
• npx playwright test - 28/28 pass, twice, both from a cold start

The credential-redaction test passes, confirming the makeRequest params change didn''t alter what gets redacted in error messages.