deps(frontend): eslint 10 + react-hooks 7 as one set (lands #413/#414)

[WalksWithASwagger]

What

Lands the coupled frontend ESLint major bump as one reviewed set (tracks #425):

• eslint 9.39.5 → 10.8.0 — supersedes build(deps-dev): bump eslint from 9.39.5 to 10.8.0 in /frontend #413
• eslint-plugin-react-hooks 5.2.0 → 7.1.1 — supersedes build(deps-dev): bump eslint-plugin-react-hooks from 5.2.0 to 7.1.1 in /frontend #414

These are mutually dependent (react-hooks 7.x is the line aligned with eslint 10) and must land together or not at all — bumping either alone breaks npm run lint.

Why one PR

Dependabot opened #413 and #414 separately; each fails the CI test gate on its own. Combining them is the only way the lint step (part of npm run verify) passes.

Changes

• frontend/package.json: bump the two devDeps above. No other dependency changes (@eslint/js stays at ^9.32.0 — its recommended config is compatible with eslint 10; lint runs clean with no missing-rule errors).
• frontend/package-lock.json: refreshed for the new resolutions.
• frontend/eslint.config.js: react-hooks 7 promotes the React-Compiler rule react-hooks/set-state-in-effect to error in its recommended set (react-hooks 5 did not enforce it). This SSR app (TanStack Start) intentionally initializes state from browser-only APIs and external stores inside mount effects (e.g. use-mobile reading window, generate reading a localStorage-backed history store, spend fetching on mount), which the heuristic flags. The single new rule is downgraded to warn — a targeted severity change, not a blanket disable, and not an eslint-disable sprinkle. All prior errors stay errors; rules-of-hooks and exhaustive-deps behavior is unchanged.

No source/runtime code changes — this is intentionally behavior-neutral so the tooling major carries zero regression risk. Adopting set-state-in-effect as an error (and refactoring the flagged effects) is a separate follow-up.

Verification

• frontend: npm run verify (typecheck + test + build + lint) passes locally (Node 26). Lint: 0 errors, 51 warnings (45 pre-existing react-refresh/only-export-components + 6 now-warning set-state-in-effect). Warnings do not fail eslint . (no --max-warnings).
• CI (Node 22.13) is the gate — see checks below.

Notes

• Supersedes build(deps-dev): bump eslint from 9.39.5 to 10.8.0 in /frontend #413 and build(deps-dev): bump eslint-plugin-react-hooks from 5.2.0 to 7.1.1 in /frontend #414. A human should close those on merge — this PR does not close them.
• needs-human: dev-tooling major, coupled bump. Review-ready, not auto-merge.