Make lint report instead of rewriting, and stop verify guessing the domain

`make lint-frontend` was `biome check --write --unsafe ./` — a lint target that
reformatted the whole tree rather than checking it, which is why every parallel
change in this repo has had to work around it. `lint` checks now and a new
`format` writes. The pre-commit hook and CI needed no edit at all: both call
`bun run lint`, so they became checks the moment its meaning changed.

`app/Makefile` assigned DOMAIN from .env, and a plain assignment beats an
inherited environment variable and is not exported — so `cd app && make
dev-local` served localhost while the same checkout's tests targeted the
configured domain. `export DOMAIN ?=` gives the lattice that was intended:
command line, then environment, then .env.

Alongside: the backend's htmlcov bind mount created that directory as root, so
`make test-backend` died on the coverage step after every test had passed,
which reads like a test failure and is not one. The alerts screen's copy of
ALERTING_EVENTS is now checked by a test rather than trusted. And the shard
comment claimed two spec files where there are nine.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Uq8mtNb97A7praJLyeEYgs

docker/compose.dev.yml

@@ -105,7 +105,6 @@ services:
         - path: ../backend/pyproject.toml
           action: rebuild
     volumes:
-      - ../backend/htmlcov:/app/backend/htmlcov
       # What makes --reload above mean anything in the detached flow (`make dev`,
       # `make dev-local`): it starts the stack with `up -d`, which never runs the
       # sync above — only `docker compose watch` does. Without the mount the