chore: strengthen backend eslint profile

test/openapi-contract.e2e-spec.ts

@@ -5,6 +5,7 @@ import { execFileSync } from 'node:child_process';
 import { mkdtemp, readFile, rm, writeFile } from 'node:fs/promises';
 import { tmpdir } from 'node:os';
 import { resolve } from 'node:path';
+
 import { AppModule } from '../src/app.module';
 import { configureApp } from '../src/main';
 import { createOpenApiDocument } from '../src/openapi';
@@ -56,6 +57,7 @@ describe('OpenAPI contract (integration)', () => {
       ['IncomeInvestmentScreenDto', 'income'],
       ['EventsInvestmentScreenDto', 'events'],
     ]) {
+      // eslint-disable-next-line security/detect-object-injection -- Keys come from local test fixtures or numeric iteration, not external input.
       const schema = schemas?.[model];
       assert(schema && !('$ref' in schema));
       expect(schema.required).toContain('screen');
@@ -84,7 +86,7 @@ describe('OpenAPI contract (integration)', () => {
         const parameters =
           document.paths[`/api/v1/brokerage-accounts/${scope}/${resource}`].get
             ?.parameters;
-        for (const name of ['from', 'to'])
+        for (const name of ['from', 'to']) {
           expect(
             parameters?.find(
               (parameter) => 'name' in parameter && parameter.name === name,
@@ -94,6 +96,7 @@ describe('OpenAPI contract (integration)', () => {
             in: 'query',
             schema: { format },
           });
+        }
       }
     }
   });
@@ -147,6 +150,7 @@ describe('OpenAPI contract (integration)', () => {
     const directory = await mkdtemp(resolve(tmpdir(), 'wealthledger-openapi-'));
     try {
       const networkGuard = resolve(directory, 'no-network.cjs');
+      // eslint-disable-next-line security/detect-non-literal-fs-filename -- Paths stay in runner-created temporary directories or explicitly selected local test builds.
       await writeFile(
         networkGuard,
         `
@@ -170,6 +174,7 @@ describe('OpenAPI contract (integration)', () => {
         },
       );
       const generated = JSON.parse(
+        // eslint-disable-next-line security/detect-non-literal-fs-filename -- Paths stay in runner-created temporary directories or explicitly selected local test builds.
         await readFile(resolve(directory, 'openapi.json'), 'utf8'),
       ) as unknown;
       expect(generated).toEqual(createOpenApiDocument(app));