webui: coordinated toolchain migration — TypeScript 6 + @eslint/js 10

[cameronsjo]

Two Dependabot majors are held because they can't land independently:

• chore(deps-dev): bump typescript from 5.9.3 to 6.0.3 in /webui #386 — typescript 5.9.3 → 6.0.x: fails the webui tsc --noEmit gate.
• chore(deps-dev): bump @eslint/js from 9.39.2 to 10.0.1 in /webui #389 — @eslint/js 9.39.2 → 10.0.1: peer-dependency break against the current eslint toolchain; webui CI has no eslint step, so CI green on that PR is not evidence of lint health.

Scope

One migration branch that:

1. Upgrades TypeScript to 6.x and fixes whatever tsc --noEmit surfaces.
2. Upgrades eslint core + @eslint/js to the 10.x line together, resolving the peer-dep graph.
3. Adds an eslint step to webui CI so future lint-toolchain bumps are actually gated.
4. Closes/supersedes chore(deps-dev): bump typescript from 5.9.3 to 6.0.3 in /webui #386 and chore(deps-dev): bump @eslint/js from 9.39.2 to 10.0.1 in /webui #389.

Why held rather than quick-patched

These are coordinated toolchain moves, not lockfile bumps — landing either alone leaves the webui build or lint in a silently broken state (decision from the 2026-07-19 follow-on campaign, Phase 0).