Make lint report instead of rewriting, and stop verify guessing the domain

`make lint-frontend` was `biome check --write --unsafe ./` — a lint target that
reformatted the whole tree rather than checking it, which is why every parallel
change in this repo has had to work around it. `lint` checks now and a new
`format` writes. The pre-commit hook and CI needed no edit at all: both call
`bun run lint`, so they became checks the moment its meaning changed.

`app/Makefile` assigned DOMAIN from .env, and a plain assignment beats an
inherited environment variable and is not exported — so `cd app && make
dev-local` served localhost while the same checkout's tests targeted the
configured domain. `export DOMAIN ?=` gives the lattice that was intended:
command line, then environment, then .env.

Alongside: the backend's htmlcov bind mount created that directory as root, so
`make test-backend` died on the coverage step after every test had passed,
which reads like a test failure and is not one. The alerts screen's copy of
ALERTING_EVENTS is now checked by a test rather than trusted. And the shard
comment claimed two spec files where there are nine.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Uq8mtNb97A7praJLyeEYgs

backend/tests/flow/test_alerts.py

@@ -1,10 +1,13 @@
 """Alerting: failing loudly once, not thirty-six thousand times."""
 
 import asyncio
+import re
+from pathlib import Path
 
 import pytest
 
 from app.flow.alerts import (
+    ALERTING_EVENTS,
     FLAP_THRESHOLD,
     RATE_LIMIT,
     Alert,
@@ -230,3 +233,17 @@ def test_a_dashboard_channel_without_a_message_says_so():
         asyncio.run(
             alerts.send(channel, Alert(title="t", body="b"), raise_on_error=True)
         )
+
+
+ALERTS_ROUTE = Path(__file__).parents[3] / "frontend/src/routes/_layout/alerts.tsx"
+
+
+@pytest.mark.skipif(not ALERTS_ROUTE.exists(), reason="no frontend in this checkout")
+def test_the_alerts_screen_offers_every_alerting_event():
+    """The chooser lists the events by hand, so it can drift out of this set.
+
+    Only the ids have to agree — the labels beside them are UI copy.
+    """
+    block = re.search(r"const EVENTS[^=]*= \[(.*?)\n\]", ALERTS_ROUTE.read_text(), re.S)
+    assert block, "the EVENTS list moved — this test needs following"
+    assert set(re.findall(r'\["(\w+)"', block.group(1))) == ALERTING_EVENTS