deps(web): combine Dependabot web upgrades + migrate React linting to ESLint 10

[MrBenJ]

Combines the five open web/npm Dependabot PRs into one branch for a single smoke test, plus the work required to make the ESLint 10 major bump actually viable.

Dependency changes

Package	From	To	Source PR
react	19.2.5	19.2.6	#32
react-dom	19.2.5	19.2.6	#39
vitest	4.1.4	4.1.6	#37
vite	8.0.8	8.1.0	#38
eslint	9.39.4	10.4.0	#34

vite note: #38 pinned 8.0.13, but that version carries a high-severity advisory (GHSA-fx2h-pf6j-xcff — server.fs.deny bypass). Took the next in-range patch (8.1.0) to clear it. npm audit is clean.

The ESLint 10 problem (the "stuff to fix")

ESLint 10 removed the legacy eslintrc system and the context.getFilename() API. The jsx-eslint eslint-plugin-react has no ESLint 10-compatible release (upstream jsx-eslint/eslint-plugin-react#3977), so the raw eslint bump broke both npm ci (peer conflict) and npm run lint (runtime crash).

Fix: replaced eslint-plugin-react with the actively maintained, flat-config-native @eslint-react/eslint-plugin (@eslint-react/* rule prefix, peer eslint: '*'), and bumped @eslint/js to v10.

• React Hooks linting stays on the official eslint-plugin-react-hooks; @eslint-react's overlapping rules-of-hooks is turned off so the official plugin remains the single source for hook rules.
• The repo's existing "advisory/warn during rollout" tuning is preserved.

Verification

• ✅ npm ci — clean install, 0 vulnerabilities
• ✅ npm run build (tsc + vite 8.1.0)
• ✅ npm run test — 263 passing
• ✅ npm run lint — 0 errors (24 advisory warnings, all warn)

⚠️ For your smoke test

Lint now reports 24 warnings from the new @eslint-react rules (e.g. no-array-index-key, naming-convention-ref-name, set-state-in-effect). They don't fail the build, but they're new signal worth eyeballing. The rule set is different from jsx-eslint's — please confirm the hangar UI behaves as expected in make build-all / fleet hangar, since this swaps the React lint engine.

Once you're happy, this supersedes #32, #34, #37, #38, #39 (close them as combined here).

🤖 Generated with Claude Code

---

Generated by Claude Code

[aria-teknal-studio]

Approved. I reviewed the combined web dependency update and ESLint 10 migration, including the React lint plugin swap and the follow-up UI code changes.

Verified locally:

• cd web && npm ci
• npm run lint
• npm run test (263 passing)
• npm run build
• npm audit --audit-level=low (0 vulnerabilities)
• make build-all

CI is green as well. The migration preserves official react-hooks linting as the hook source of truth, and the UI changes look like reasonable lint-driven cleanups.

One tiny non-blocking follow-up: npm run lint now emits Node's MODULE_TYPELESS_PACKAGE_JSON warning because eslint.config.js is ESM syntax while web/package.json does not declare type: module. It does not fail lint/build/tests, so I would not block this PR on it, but adding type: module or renaming the config to eslint.config.mjs would quiet the warning later.