Make lint report instead of rewriting, and stop verify guessing the domain

`make lint-frontend` was `biome check --write --unsafe ./` — a lint target that
reformatted the whole tree rather than checking it, which is why every parallel
change in this repo has had to work around it. `lint` checks now and a new
`format` writes. The pre-commit hook and CI needed no edit at all: both call
`bun run lint`, so they became checks the moment its meaning changed.

`app/Makefile` assigned DOMAIN from .env, and a plain assignment beats an
inherited environment variable and is not exported — so `cd app && make
dev-local` served localhost while the same checkout's tests targeted the
configured domain. `export DOMAIN ?=` gives the lattice that was intended:
command line, then environment, then .env.

Alongside: the backend's htmlcov bind mount created that directory as root, so
`make test-backend` died on the coverage step after every test had passed,
which reads like a test failure and is not one. The alerts screen's copy of
ALERTING_EVENTS is now checked by a test rather than trusted. And the shard
comment claimed two spec files where there are nine.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Uq8mtNb97A7praJLyeEYgs

development.md

@@ -14,9 +14,9 @@ SPA, the API and the marketing site answer on one port. `make status` lists the
 `make down` stops everything.
 
 The hostname comes from `DOMAIN` in `app/.env`, which `scripts/setup.sh` copies out of the
-root `.env` — change it there and re-run `make init`. `make dev DOMAIN=…` at the root does
-*not* reach this stack: `app/Makefile` assigns `DOMAIN` from `app/.env`, and a makefile
-assignment overrides an inherited environment variable.
+root `.env` — change it there and re-run `make init`. `app/Makefile` takes that value as a
+default only (`export DOMAIN ?= …`), so `make dev DOMAIN=…` overrides it and the override
+reaches the recipes.
 
 **App only.** `cd app && make dev` starts this stack on its own Traefik with all host ports
 published, in the foreground. `make dev-utils` starts just db, adminer, proxy, mailcatcher
@@ -145,15 +145,18 @@ run when either origin resolves outside loopback or the private ranges, because
 creates and deletes flows, dashboards and users. `PLAYWRIGHT_ALLOW_PUBLIC=1` overrides it.
 
 **Visual check.** From the root, `make verify` logs in and screenshots both themes into
-`app/frontend/screenshots/{light,dark}/`; `make verify-docker` does the same from the
-Playwright container when the host lacks the browser libraries. Both default to `localhost`
-rather than reading `.env`, so on a checkout configured for a deployment name the domain the
-stack actually serves: `make verify DOMAIN=example.com`.
+`app/frontend/screenshots/{light,dark}/`. It is an alias for `make verify-docker`: the run
+always happens in the Playwright container, which pins the browser by reading
+`frontend/package.json`. Running Playwright on the host is unsupported — the workspace pins a
+browser revision whose install is incomplete. The domain comes from `.env`, and
+`make verify DOMAIN=example.com` still wins.
 
 ## Lint, hooks and the generated client
 
-`make lint` runs ruff, mypy and biome. `make hooks` at the root installs the pre-commit
-hooks in both stacks; `.pre-commit-config.yaml` holds them. One is worth knowing about:
+`make lint` runs ruff, mypy and biome, and only reports — it is what the pre-commit hook and
+CI run, so neither rewrites the tree. `make format-frontend` is the writing half, applying
+biome's fixes. `make hooks` at the root installs the pre-commit hooks in both stacks;
+`.pre-commit-config.yaml` holds them. One is worth knowing about:
 `generate-frontend-sdk` regenerates the SPA's API client from the backend's OpenAPI schema
 whenever anything under `backend/` changes, so a route change reaches the frontend without
 being asked. `make generate-client` forces it.