fix(ci): make ntask web lint runnable and gate on it

[acamarata]

The gap

web/package.json has carried a lint script (eslint .) since the app moved into
this repo, but no CI job has ever run it. grep lint .github/workflows/ci.yml
returns nothing. So eslint has never gated anything here.

It also could not have run if someone had tried. eslint.config.mjs imports
typescript-eslint and eslint-plugin-react-hooks; neither was in
devDependencies. Invoking it fails at config load, before linting a single file:

Error [ERR_MODULE_NOT_FOUND]: Cannot find package 'eslint-plugin-react-hooks'
imported from web/eslint.config.mjs

Why just adding the CI step would have turned main red

With the two packages installed, eslint . reports 3151 problems (2588 errors).

All 2588 errors are in .vercel/ — four minified vercel build bundles, linting as
no-unused-expressions noise at column offsets like 1:22188. The ignores list
already had node_modules/, dist/, .next/, .turbo/ and coverage/, but not
.vercel/. That omission is almost certainly why the script was never wired up:
anyone who tried it got a wall of errors from build output and moved on.

The source itself is clean. Across 173 files under web/src: 0 errors, 1
warning (an exhaustive-deps hint in ListsPage.tsx).

Changes

File	Change
web/package.json	Add typescript-eslint@^8.70.0, eslint-plugin-react-hooks@^7.1.1
web/eslint.config.mjs	Add .vercel/ to ignores, alongside dist/
.github/workflows/ci.yml	Add blocking Lint step to web-test
pnpm-lock.yaml	Regenerated — CI installs --frozen-lockfile

No gate weakened

No continue-on-error, no rule turned off or downgraded, nothing added to an ignore
list except build output that sits next to dist/. The one src warning is left
as a warning because that is how react-hooks/exhaustive-deps is already configured
in this repo — this PR does not change severity levels.

Verification

$ pnpm --filter ntask lint
web lint$ eslint .
web lint:   45:6  warning  React Hook useEffect has a missing dependency: 't'
web lint: ✖ 1 problem (0 errors, 1 warning)
web lint: Done

Exit 0. The CI run on this PR is the real check that it holds on a clean runner
checkout, where .vercel/ will not even exist.

Context

Closes the eslint-never-runs finding in P6-E11-W2-S4-T25, whose acceptance
requires pnpm --filter ntask lint as a blocking step on every push/PR — hence that
exact invocation rather than the working-directory: web form the neighbouring steps
use. The name field in web/package.json is literally ntask, so the filter
resolves.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated
ntask-web	Ignored		Sep 13, 2026 8:01am UTC

[acamarata]

Closing — superseded. I branched from a local main that was 5 commits stale and did
not see #171, which already wired pnpm --filter ntask lint as a blocking CI step on
2026-09-01 and added eslint-plugin-react-hooks to devDependencies. That covers the
substance of this PR, so it is duplicate work. My mistake for not fetching first.

Two small residual findings from this branch, neither urgent, recorded here rather
than carried in a redundant PR:

1. .vercel/ is not in eslint.config.mjs ignores. dist/, .next/, .turbo/
   and coverage/ are. On a clean CI runner .vercel/ does not exist, which is why
   ci(web): wire the existing eslint config into CI as a blocking gate #171's run was green — but any developer who has run a local vercel build gets
   2588 errors from four minified bundles and cannot lint at all. One line next to
   dist/ fixes it.

2. typescript-eslint is imported by eslint.config.mjs but not declared in
   web/package.json devDependencies. It currently resolves through workspace
   hoisting, so nothing is broken today, but the config depends on a package it does
   not declare.

Neither blocks anything. Worth folding into the next change that touches that config.