Run the Web ESLint config from package scripts and CI

[DeliciousBuding]

Summary

app/web has an ESLint config, and the repository guide says each app has its own pnpm lint check, but the web package cannot currently run that check and CI does not invoke it.

Evidence

• app/web/eslint.config.js defines strict TypeScript and React Hooks lint rules.
• app/web/package.json scripts only include dev, build, preview, test, test:watch, test:coverage, and typecheck; there is no lint script.
• app/web/package.json also does not declare the ESLint-related dev dependencies needed by that config, such as eslint, @eslint/js, typescript-eslint, or eslint-plugin-react-hooks.
• .github/workflows/checks.yml runs Desktop typecheck, lint, and tests, but the frontend-web job only installs dependencies and runs pnpm build.
• AGENTS.md says each app has an independent ESLint config and that Web lint has been added.

Impact

The web app can regress on the lint rules that are already checked into the repository, and maintainers can reasonably assume pnpm lint works for app/web when it does not. This also leaves the Desktop frontend with a stronger CI quality gate than the Web frontend even though both are part of the same AgentHub UI surface.

Expected

Make the checked-in Web ESLint config executable and enforce it consistently:

• Add the required ESLint dev dependencies to app/web/package.json and lockfile.
• Add a lint script for app/web.
• Run that script in the frontend-web GitHub Actions job.
• Keep AGENTS.md accurate if the intended policy is different.

Acceptance criteria

• cd app/web && pnpm lint runs the checked-in eslint.config.js.
• The frontend-web CI job fails on Web lint errors.
• Web lint dependencies are declared by app/web, not only available accidentally from another workspace.