chore(lint): migrate off next lint to the ESLint CLI and flat config

`next lint` is deprecated and disappears in Next 16. apps/web now runs
`eslint .` against eslint.config.mjs on ESLint 9, and the shared preset moves
to packages/config/eslint-preset.mjs. eslint-config-next 15 still ships only
an eslintrc-style config, so FlatCompat translates it; that keeps
next/core-web-vitals as the single source of rules.

The migration was done by hand rather than via @next/codemod, because the
codemod does not know about the shared @repo/config preset.

Two things worth knowing.

ESLint 9 only walks file extensions that some config names in `files`. The
first working version of this config linted three loose .js files, skipped
every .tsx in src/, and still exited 0 -- a green run that checked nothing.
The preset now names the extensions explicitly. Coverage went from 3 files to
82, and a deliberately broken canary component confirms rules still fire.

`@eslint/eslintrc` also needed a second scoped override: it does a default
import of minimatch and declares ^3.1.2, which the global ^9.0.7 audit
override broke. Same shape as the ajv fix in the previous commit.

packages/config/eslint-preset.js

@@ -1,6 +0,0 @@
-module.exports = {
-  extends: ["next/core-web-vitals"],
-  rules: {
-    // strict accessibility rules will go here later
-  }
-};

packages/config/eslint-preset.mjs

@@ -0,0 +1,26 @@
+import { dirname } from "node:path";
+import { fileURLToPath } from "node:url";
+import { FlatCompat } from "@eslint/eslintrc";
+
+// eslint-config-next 15 still ships only an eslintrc-style config (no flat export),
+// so FlatCompat translates it. baseDirectory is THIS package, because that is where
+// eslint-config-next is declared and therefore resolvable from.
+const compat = new FlatCompat({
+  baseDirectory: dirname(fileURLToPath(import.meta.url)),
+});
+
+/** Shared flat config for every app in the monorepo. */
+const config = [
+  // ESLint 9 only walks extensions that some config names in `files`. Without this,
+  // `eslint .` silently lints the three loose .js files and skips all of src/*.tsx
+  // while still exiting 0 -- a green run that checked nothing.
+  { files: ["**/*.{js,jsx,mjs,cjs,ts,tsx}"] },
+  ...compat.extends("next/core-web-vitals"),
+  {
+    rules: {
+      // strict accessibility rules will go here later
+    },
+  },
+];
+
+export default config;

packages/config/package.json

@@ -4,11 +4,14 @@
   "private": true,
   "files": [
     "tsconfig.json",
-    "eslint-preset.js"
+    "eslint-preset.mjs"
   ],
   "devDependencies": {
-    "eslint": "^8.57.0",
-    "eslint-config-next": "^15.1.3",
+    "eslint": "^9.0.0",
     "typescript": "^5.4.0"
+  },
+  "dependencies": {
+    "@eslint/eslintrc": "^3.3.1",
+    "eslint-config-next": "^15.1.3"
   }
-}
+}