fix(lint): clear the pre-existing Biome errors so the lint gate reflects PR content

[vishkaty]

What

The Lint Code Base check currently goes red on any PR that touches a Biome relevant file type, because Super Linter runs Biome across the workspace and main carries dozens of pre existing Biome errors (a clean checkout of e1ea56d reports 65 errors from npx @biomejs/biome@2 lint code/web-client/src docs/assets, and the CI Biome reports more because its severity mapping is stricter). PRs touching only Python skip Biome and look green, so the gate reflects which file types a PR touches rather than its content. Offered in a comment on #307; this change clears the debt so the gate becomes meaningful for every contributor.

Changes, grouped

• 13 docs/assets SVGs: a title element added as the first child of svg (text derived from the filename), fixing noSvgWithoutTitle. The 10 generated diagrams also had their obsolete SVG 1.0 DOCTYPE and XML declaration prologues removed; the CI Biome parser rejects both (all its parse errors are at 1:1 on these files), and neither affects how browsers or GitHub render the images. All 13 files re validated as well formed XML.

• Web client, semantics preserved throughout: type="button" on 9 non submitting buttons (the client contains no form element); aria-hidden="true" on 8 decorative inline icons; one div role="button" converted to a real button with user agent styles neutralized in the stylesheet; one list key switched from array index to the per disclosure salt; two string concatenations converted to template literals; Number.isNaN on an already numeric value; optional chaining in two conditionals; the root element non null assertion replaced with an explicit check; two guarded non null assertions replaced with coalescing; one unnecessary import.meta as any cast removed (vite client types already cover it).

• Hook dependencies: two genuinely missing deps added (fetchMandate, a stable useCallback, and monitoringData?.qty, which the poll body reads); the scroll on new message effect now reads chatState.messages.length in its guard so its dependency is genuine, with behavior unchanged apart from not scrolling an empty chat.

• Stylesheet: the touched InventoryOptionsCard.scss brought current with stylelint standard (modern color function notation, percentage alpha, unquoted font family), since Super Linter lints changed stylesheets.

• Dead code in mandateEntries.ts removed; this also fixes npm run build, which fails on current main with three unused declaration tsc errors and passes after this change.

• cspell: the generated diagram SVGs (249 Raphael object ids) are excluded via ignorePaths rather than polluting the dictionary; the three legitimate code words are added to custom words.

• Linter workflow: four more validators joined the existing disable list. CSS_PRETTIER and TYPESCRIPT_PRETTIER follow the pattern already set for the markdown, javascript, json and yaml prettier variants. TSX and TYPESCRIPT_ES run the bundled ESLint default config, which expects the legacy React in scope JSX transform and cannot resolve extensionless TypeScript imports, so they flag every line of the Vite based web client regardless of content; Biome and tsc via the vite build cover those files. These four had never fired before because no PR had touched a stylesheet or TypeScript file since the linter was configured. Happy to take a different direction here if you prefer, for example a repo ESLint config instead of disabling. Editing the workflow also brought it into zizmor scope, which flagged two of its own preexisting findings; both are addressed here: the two action references are now pinned to their release commit hashes (checkout v5, super linter v8.7.0, the exact version whose behavior this PR was validated against), and the workflow declares least privilege permissions (contents read, statuses write).

Verification

• npx @biomejs/biome@2 lint code/web-client/src docs/assets: zero findings of any severity (no errors, no warnings, no infos). Whole workspace: zero across all 80 files, so the workspace wide Biome pass cannot trip on anything regardless of severity mapping.
• Every site the previous CI run flagged is individually fixed, including the stylelint list for the touched stylesheet.
• npm run build in code/web-client passes (it fails on clean main).
• cspell on the changed files: 0 issues. No Python files touched. No biome config was added; every fix is semantic, not suppression.

[gemini-code-assist]

Caution

The consumer version of Gemini Code Assist on GitHub has been sunset. All code review activity has officially ceased.