Add ESLint and Prettier

Prettier owns formatting: .prettierrc.json, format and format:check scripts, and
a one-off pass over the repo so the check is green from the start. Embedded
language formatting is off deliberately - the renderers build HTML in html
tagged templates and letting Prettier reflow those would change the markup
customers receive. docs/ is excluded because it is hand-wrapped prose, and shell
scripts have no Prettier parser.

ESLint covers the JavaScript: the two browser scripts, the build and check
scripts, and its own config. no-var is scoped out for the browser scripts on
purpose; they are plain ES5-shaped IIFEs and a hoisting difference would only
show up in a browser.

ESLint cannot lint the TypeScript here: typescript@7 is the native port with no
JavaScript compiler API, and typescript-eslint requires a 4.8-6.1 peer, so it
refuses to install and forcing it through would leave a parser that cannot read
the compiler. tsc --noEmit stays the TypeScript gate; README records the two
ways to change that.

lint and format:check now run in deploy.sh, and VS Code formats on save with
Prettier and surfaces ESLint findings.

test/auth.test.ts

@@ -28,7 +28,13 @@ describe('the admin password', () => {
   });
 
   it('rejects malformed stored values instead of throwing', async () => {
-    for (const stored of ['', 'plaintext', 'scrypt$1$2$3', 'bcrypt$1$2$3$4$5', 'scrypt$x$8$1$aa$bb']) {
+    for (const stored of [
+      '',
+      'plaintext',
+      'scrypt$1$2$3',
+      'bcrypt$1$2$3$4$5',
+      'scrypt$x$8$1$aa$bb',
+    ]) {
       assert.equal(await verifyPassword('anything', stored), false);
     }
   });
@@ -63,7 +69,11 @@ describe('the session token', () => {
 describe('the login throttle', () => {
   it('blocks the sixth failure inside the window and reports how long to wait', () => {
     let time = NOW.getTime();
-    const throttle = new LoginThrottle({ maxFailures: 5, windowMs: 60_000, now: () => new Date(time) });
+    const throttle = new LoginThrottle({
+      maxFailures: 5,
+      windowMs: 60_000,
+      now: () => new Date(time),
+    });
 
     for (let attempt = 0; attempt < 5; attempt += 1) {
       assert.equal(throttle.check('1.2.3.4').allowed, true);