chore: strengthen backend eslint profile

test/container-smoke.cjs

@@ -6,6 +6,7 @@ const { randomUUID } = require('node:crypto');
 const image = process.argv[2];
 assert.ok(image, 'Pass a built backend image reference');
 const name = `wealthledger-smoke-${randomUUID()}`;
+// eslint-disable-next-line sonarjs/no-os-command-from-path -- Developer-only command uses the operator PATH and fixed executable/arguments; no request input.
 const docker = (...args) => execFileSync('docker', args, { encoding: 'utf8' }).trim();
 const environment = [
   '-e', 'DATABASE_URL=file:/data/wealthledger.db',
@@ -64,6 +65,13 @@ async function ready() {
     `);
     console.log('PASS image: fresh/existing migration, non-root read-only runtime, auth, persistence, proto assets');
   } finally {
-    try { docker('rm', '-f', name); } finally { docker('volume', 'rm', name); }
+    try {
+      docker('rm', '-f', name);
+    } finally {
+      docker('volume', 'rm', name);
+    }
   }
-})().catch((error) => { console.error(error); process.exitCode = 1; });
+})().catch((error) => {
+  console.error(error);
+  process.exitCode = 1;
+});