chore(lint): migrate off next lint to the ESLint CLI and flat config

`next lint` is deprecated and disappears in Next 16. apps/web now runs
`eslint .` against eslint.config.mjs on ESLint 9, and the shared preset moves
to packages/config/eslint-preset.mjs. eslint-config-next 15 still ships only
an eslintrc-style config, so FlatCompat translates it; that keeps
next/core-web-vitals as the single source of rules.

The migration was done by hand rather than via @next/codemod, because the
codemod does not know about the shared @repo/config preset.

Two things worth knowing.

ESLint 9 only walks file extensions that some config names in `files`. The
first working version of this config linted three loose .js files, skipped
every .tsx in src/, and still exited 0 -- a green run that checked nothing.
The preset now names the extensions explicitly. Coverage went from 3 files to
82, and a deliberately broken canary component confirms rules still fire.

`@eslint/eslintrc` also needed a second scoped override: it does a default
import of minimatch and declares ^3.1.2, which the global ^9.0.7 audit
override broke. Same shape as the ajv fix in the previous commit.

package.json

@@ -33,6 +33,7 @@
       "ajv": "^8.17.1",
       "eslint>ajv": "^6.12.6",
       "@eslint/eslintrc>ajv": "^6.12.6",
+      "@eslint/eslintrc>minimatch": "^3.1.2",
       "brace-expansion": "^2.0.3",
       "postcss": "^8.5.14",
       "fast-uri": "^3.1.2"