Clear the last lint warnings and make them errors

[mtaanquist]

Closes #37 — the tidy-up pass, kept until last as agreed.

25 warnings → 0, in both halves, at --max-warnings 0. no-explicit-any and no-empty-object-type are errors again.

The any types

apiCall is generic now, so a caller states what it expects:

setDrinks(await apiCall<Drink[]>(`/drinks/bar/${barId}`));

Switching the default to unknown broke 19 call sites — every one a payload that had never been typed. Two were API shapes with no name at all, so SignedIn and BarQrCode are in shared/types.d.ts and the routes return them with satisfies.

The rest: ["--color-fg-default" as any] became a React.CSSProperties assertion on the object; status as any became an OrderStatus parameter; PastOrders took orders: any[] and customerOrder: any; LoginForm built its body as any so it could add a field conditionally, which is a spread now.

The effect dependencies

Fixed rather than silenced, as the issue asked. This only became possible once apiCall was stable (#30) — before that, listing it would have re-run the effects on every render.

The fetchers in BarSelector, BartenderDashboard, CategoriesTab and DrinkForm are memoised on barId and listed properly, so a stale closure can't hold an old bar id. useSessionManager's clearSession likewise — that one sits in the session-timeout effect, exactly where the issue warned a stale closure would produce "it stopped updating".

ImageCropper was the one needing thought: it watched initialCrop.x/.y while the rule wanted the object, but the caller rebuilds that object every render, so depending on it would reset the crop mid-drag. It destructures the two numbers instead.

Fast refresh

useApp and useLiveUpdates, and the contexts they read, moved to hooks/. Those files export no components, so the providers hot-reload properly and the eslint-disable in LiveUpdatesContext is gone.

Keeping it clean

Both lint scripts run with --max-warnings 0 and CI calls them, so warnings can't quietly accumulate again. CLAUDE.md says any is an error in both halves, and that an unknown shape belongs in shared/types.d.ts.

Checked

70 backend tests, both linters, both typecheckers, both builds — clean.

Ran the built image against a copy of the production database and drove it in a headless browser again, since this touched sign-in, the live connection and the session hook:

• guest page: 18 sections, 302 cards, Gin filter gives 31, surprise-me and Escape work, every endpoint fetched exactly once
• bartender: reports, drink form populated correctly, add-drink blank, QR modal renders its image and address
• no console errors anywhere