Make lint report instead of rewriting, and stop verify guessing the domain

`make lint-frontend` was `biome check --write --unsafe ./` — a lint target that
reformatted the whole tree rather than checking it, which is why every parallel
change in this repo has had to work around it. `lint` checks now and a new
`format` writes. The pre-commit hook and CI needed no edit at all: both call
`bun run lint`, so they became checks the moment its meaning changed.

`app/Makefile` assigned DOMAIN from .env, and a plain assignment beats an
inherited environment variable and is not exported — so `cd app && make
dev-local` served localhost while the same checkout's tests targeted the
configured domain. `export DOMAIN ?=` gives the lattice that was intended:
command line, then environment, then .env.

Alongside: the backend's htmlcov bind mount created that directory as root, so
`make test-backend` died on the coverage step after every test had passed,
which reads like a test failure and is not one. The alerts screen's copy of
ALERTING_EVENTS is now checked by a test rather than trusted. And the shard
comment claimed two spec files where there are nine.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Uq8mtNb97A7praJLyeEYgs

frontend/src/routes/_layout/alerts.tsx

@@ -35,9 +35,10 @@ const alertsKey = ["alerts", "config"]
 const SECTION =
   "text-xs font-medium uppercase tracking-[0.5px] text-muted-foreground"
 
-/** What the engine can alert on. Mirrors `ALERTING_EVENTS` in the backend; a
- *  rule with none of them ticked still covers everything, including any event
- *  added there later. */
+/** What the engine can alert on. Mirrors `ALERTING_EVENTS` in the backend, and
+ *  `backend/tests/flow/test_alerts.py` reads this list to fail when the two
+ *  drift apart. A rule with none of them ticked still covers everything,
+ *  including any event added there later. */
 const EVENTS: [string, string][] = [
   ["node_error", "A node failed"],
   ["node_health", "A connection dropped"],