chore(lint): adopt the React Compiler rules, holding set-state-in-effect back

[tyler-rich]

Step 3 of the frontend toolchain sweep in docs/upgrades/frontend-toolchain-86.md — the step that
document flags as "a separate decision; may be declined" and prices as "unbounded until
measured". Adopted, with one rule held back.

No dependency version moves. frontend/package.json and frontend/package-lock.json are
byte-identical; the lockfile SHA-256 was captured before the baseline install and re-verified after
the final one. typescript stays at 5.7.2 (step 4).

The cost, measured before anything landed

Obtained with a throwaway probe config (a copy of eslint.config.js with the spread restored, run
via --config, then deleted), so the tracked tree was never modified to take the measurement.

Count	Severity	Rule
18	error	react-hooks/set-state-in-effect
6	error	react-hooks/refs
0	—	the other 12

Twelve of the fourteen rules report nothing — including immutability, purity and
preserve-manual-memoization, which the scoping doc's Step 3 row expected to fire in volume.

What this PR does

• Restores ...reactHooks.configs.recommended.rules, removing step 2's holding edit.
• Sets react-hooks/set-state-in-effect: 'off' with the reasoning inline and a pointer to Enable react-hooks/set-state-in-effect: six genuine synchronous-setState sites to refactor first #176.
• Fixes the 6 react-hooks/refs findings by hand.

react-hooks/refs — 6 findings, fixed

All six are one idiom in ScansPage.tsx: a useRef(viewFromParams(searchParams)) whose .current
was read during render to seed six useState initializers. Replaced with a lazy useState
initializer, which runs viewFromParams exactly once on first render as the ref did, without the
render-time ref read. initialView had no other use in the file; useRef stays imported for
historyGuard.

react-hooks/set-state-in-effect — 18 findings, rule held back (#176)

Only 6 of the 18 are the synchronous setState the rule's rationale describes. #176 tracks
them, and names the two that are deliberate effects which each closed a real bug — ScanDetailPage's
:scanId reset (L17/P2-2) and ScansPage's compare reconcile (P3-2) — so a later
session doesn't "fix" them blind and re-open what they closed.

The other 12 are the fetch-on-mount idiom, where every setState runs after an await. These
are reported, not worked around, and are deliberately outside #176's scope. A three-shape probe
against the installed 7.1.1, with load defined in the component body:

Shape	Reported?
void load()	yes
void (async () => { await load(); })()	no
load().catch(() => {})	yes

The first two are semantically identical, and moving the same load behind a custom hook silences
all three. So the report tracks what the compiler can see through, not a behavioural difference —
and the available "fixes" are a wrapper that changes nothing or a data-fetching refactor that hides
the call from the analyser. Neither is an improvement; if that refactor is ever worth doing it is
its own decision.

Verification

eslint --print-config before and after, on an app .tsx, a library .ts and a test override —
all three moved identically, 121 → 135 rules, with nothing else changed at any severity:

Severity	Rules added
error (11)	config, error-boundaries, gating, globals, immutability, preserve-manual-memoization, purity, refs, set-state-in-render, static-components, use-memo
warn (2)	incompatible-library, unsupported-syntax
off (1)	set-state-in-effect

Counts reconcile: configs.recommended is 16 rules, of which rules-of-hooks and exhaustive-deps
were already present from step 2, so the delta is exactly +14.

Suites, from a fresh rm -rf node_modules && npm ci: lint clean, format:check clean, 79 tests
across 21 files, npm audit 0 vulnerabilities, build green.

The bundle moves, and should: index-BNB6IweX.js 645.18 kB → index-Vvdzytcz.js 645.14 kB.
Steps 1 and 2 were provably lint-only with identical asset hashes; this step changes runtime code in
ScansPage.tsx, so the new hash is the honest signal that it did. CSS untouched
(index-D2wHtcHV.css).

Not done

No --fix, in bulk or individually. No rule disabled beyond the single authorised override. No step
4 work. docs/upgrades/frontend-toolchain-86.md and docs/ROADMAP.md not edited — correcting the
sequence document is a maintainer call.

See docs/ARCHIVE.md § Deviations for changes made in this step.