Clear the pre-existing lint backlog in index.jsx, main.js, and preload.js

[juanmaguitar]

Summary

• The repo had no linter until Add automated PR review: ESLint for style, an agent for judgement #112, so eslint . reports pre-existing findings across files nobody had touched since — 57 of them concentrated in src/renderer/index.jsx, src/main.js, and src/preload.js. These three kept blocking Add an update path so sites can move to the latest trunk #111's lint check on lines that PR never modified.
• Clears all of them in these three files. lint.yml still only lints changed files, but once eslint eventually moves to the full repo, these three won't be part of the remaining work.
• Mechanical fixes (unused vars/imports, nested ternaries, no-unused-expressions, no-shadow, eqeqeq, prefer-const, JSDoc @param) preserve behavior exactly.
• Judgment calls, each documented inline:
  • console.* in the SMTP handler → the existing logEvent/logError helpers from ./logging, matching the rest of the main process.
  • alert()/confirm() are left in place with justified eslint-disable comments — replacing this file's whole alert-based UX convention is a separate, larger change than a lint cleanup should make.
  • Two dead zip-download-era leftovers removed: downloadFile() and WORDPRESS_ZIP_URL (and their now-unused https/extract-zip imports) — the app clones via git now, nothing calls either.
  • A couple of genuine accessibility gaps fixed: the email list row gets a keyboard handler alongside its click handler, and an anchor styled as a button became a real <button>.

Test plan

• npx eslint --max-warnings=0 --no-warn-ignored src/renderer/index.jsx src/main.js src/preload.js — clean
• npm test — 113/113 passing
• npx eslint . — remaining findings are all outside these three files (untouched by this PR)

🤖 Generated with Claude Code

[github-actions]

Findings: 0 🔴 · 0 🟡 · 0 🔵 — no findings across the five dimensions.

This is the first automated review pass on this PR (no prior summary to reconcile).

Verified against .github/ai-review-rules.md:

• Architecture — no spawns, IPC surface, persistence shape, or streaming path touched. downloadFile/WORDPRESS_ZIP_URL/extract-zip import removal is dead code from the retired zip-download flow (confirmed no remaining references anywhere in src/, test/).
• Security — no IPC handler, url:open, loopback binding, or spawn shell option touched.
• Performance — no change to per-chunk log handling or work that scales with the site registry.
• Cross-platform — no path composition, process-kill, or Windows-specific code touched.
• Tests — pure lint cleanup with no behavior change, so no new test is required. Spot-checked the two reordering diffs in src/main.js (playground:start's buildDir, startWpDebugTail's wpContentDir/filePath) — both moves are after their guard return, so no early-use regression.

Also checked by hand, since these are exactly the kind of thing a mechanical lint pass can get wrong silently:

• src/renderer/index.jsx: sidebar's dead createdLabel/statusLabel locals were never rendered in that scope (confirmed against origin/trunk) — distinct from SiteRow's own createdLabel, which is untouched and still renders. emailViewTab state was already write-only (no read site found) before being trimmed to [, setEmailViewTab]. The webStarting/serverUrl ternary-to-sibling-JSX-expression splits render the same output.
• src/main.js: SMTP handler's console.log/console.error → logEvent/logError matches the pattern already used everywhere else in this file (playground:start, playground-web:start, quit sweep).

Style / process notes (non-blocking)

• extract-zip is still listed in package.json/package-lock.json but, after this PR, has no remaining call site in the source tree. Worth pruning in a follow-up so the dependency list matches actual usage — not urgent, and outside this PR's stated scope (lint backlog, not dependency hygiene).