Make lint report instead of rewriting, and stop verify guessing the domain

`make lint-frontend` was `biome check --write --unsafe ./` — a lint target that
reformatted the whole tree rather than checking it, which is why every parallel
change in this repo has had to work around it. `lint` checks now and a new
`format` writes. The pre-commit hook and CI needed no edit at all: both call
`bun run lint`, so they became checks the moment its meaning changed.

`app/Makefile` assigned DOMAIN from .env, and a plain assignment beats an
inherited environment variable and is not exported — so `cd app && make
dev-local` served localhost while the same checkout's tests targeted the
configured domain. `export DOMAIN ?=` gives the lattice that was intended:
command line, then environment, then .env.

Alongside: the backend's htmlcov bind mount created that directory as root, so
`make test-backend` died on the coverage step after every test had passed,
which reads like a test failure and is not one. The alerts screen's copy of
ALERTING_EVENTS is now checked by a test rather than trusted. And the shard
comment claimed two spec files where there are nine.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Uq8mtNb97A7praJLyeEYgs

.gitea/workflows/playwright.yml

@@ -37,9 +37,10 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        # Two spec files (tests/flows.spec.ts, tests/admin.spec.ts) plus
-        # tests/auth.setup.ts, which every shard reruns as its setup project.
-        # More shards than that would only pay container startup twice over.
+        # Nine spec files under tests/, plus tests/auth.setup.ts, which every
+        # shard reruns as its setup project. Split two ways: each shard pays a
+        # full compose stack's startup, so more of them would spend more time
+        # booting than testing.
         shardIndex: [1, 2]
         shardTotal: [2]
     env: