chore: finish frontend ESLint migration #18

Enable every plugin recommended preset and replace Biome with ESLint formatting.

Preserve API contracts and JSX whitespace; verify source, tests, builds and tooling.

scripts/check-openapi.mjs

@@ -1,14 +1,14 @@
 import { spawnSync } from "node:child_process";
 import { mkdtemp, readFile, rm } from "node:fs/promises";
 import { tmpdir } from "node:os";
-import { join, resolve } from "node:path";
+import nodePath from "node:path";
 
 const temporaryDirectory = await mkdtemp(
-	join(tmpdir(), "wealth-ledger-openapi-"),
+	nodePath.join(tmpdir(), "wealth-ledger-openapi-"),
 );
-const generatedPath = join(temporaryDirectory, "schema.d.ts");
-const committedPath = resolve("src/shared/api/generated/schema.d.ts");
-const cliPath = resolve("node_modules/openapi-typescript/bin/cli.js");
+const generatedPath = nodePath.join(temporaryDirectory, "schema.d.ts");
+const committedPath = nodePath.resolve("src/shared/api/generated/schema.d.ts");
+const cliPath = nodePath.resolve("node_modules/openapi-typescript/bin/cli.js");
 let exitCode = 0;
 
 try {
@@ -18,12 +18,10 @@ try {
 		{ encoding: "utf8" },
 	);
 
-	if (generated.status !== 0) {
-		process.stderr.write(generated.stderr || generated.stdout);
-		exitCode = generated.status ?? 1;
-	} else {
+	if (generated.status === 0) {
 		const [committed, current] = await Promise.all([
 			readFile(committedPath, "utf8"),
+			// eslint-disable-next-line security/detect-non-literal-fs-filename -- Path is built from this check’s private mkdtemp directory and fixed filenames.
 			readFile(generatedPath, "utf8"),
 		]);
 		if (committed !== current) {
@@ -33,8 +31,13 @@ try {
 			exitCode = 1;
 		}
 	}
-} finally {
-	await rm(temporaryDirectory, { recursive: true, force: true });
+	else {
+		process.stderr.write(generated.stderr || generated.stdout);
+		exitCode = generated.status ?? 1;
+	}
+}
+finally {
+	await rm(temporaryDirectory, { force: true, recursive: true });
 }
 
 process.exitCode = exitCode;