chore(lint): prefix unused args with _ and promote no-unused-vars to error

Cleanup flagged by the CI review, then harden the gate so unused
identifiers fail lint instead of merely warning:

- background.js: the two consent handlers (handleGetPublicKey,
  handleSignEvent) receive `sender` but never use it -> `_sender`.
- nip98-interceptor.js: the XHR setRequestHeader override only inspects
  the header `name` (and forwards `arguments`); the `value` arg is
  unused -> `_value`.
- test/storage.test.js: drop the unused `before`/`after` imports (the
  suite uses inline clearStorage() calls).
- .eslintrc.json: no-unused-vars "warn" -> "error", keeping the
  ^_ ignore patterns for args/vars/caught-errors.

Lint is 0 errors / 0 warnings; build and the 133-test suite stay green.

Co-Authored-By: jjohare <github@thedreamlab.uk>

Author: jjohare

.eslintrc.json

@@ -16,7 +16,7 @@
     "no-implied-eval": "error",
     "no-undef": "error",
     "no-unused-vars": [
-      "warn",
+      "error",
       {
         "argsIgnorePattern": "^_",
         "varsIgnorePattern": "^_",

src/background.js

@@ -118,7 +118,7 @@ async function handleMessage (message, sender) {
 /**
  * Get public key with user permission
  */
-async function handleGetPublicKey (origin, sender) {
+async function handleGetPublicKey (origin, _sender) {
   // Check if keypair exists
   const keyExists = await hasKeypair();
   if (!keyExists) {
@@ -151,7 +151,7 @@ async function handleGetPublicKey (origin, sender) {
 /**
  * Sign event with user permission
  */
-async function handleSignEvent (event, origin, sender) {
+async function handleSignEvent (event, origin, _sender) {
   // Check if keypair exists
   const keyExists = await hasKeypair();
   if (!keyExists) {

src/nip98-interceptor.js

@@ -227,7 +227,7 @@
   // Track page-set Authorization on XHR so we don't overwrite it in send().
   // setRequestHeader auto-merges values per the XHR spec, but a merged
   // "DPoP xxx, Nostr yyy" still confuses servers that branch on scheme.
-  XMLHttpRequest.prototype.setRequestHeader = function (name, value) {
+  XMLHttpRequest.prototype.setRequestHeader = function (name, _value) {
     if (typeof name === 'string' && name.toLowerCase() === 'authorization') {
       this._podkeyHasPageAuth = true;
     }

test/storage.test.js

@@ -3,7 +3,7 @@
  * Note: These tests require Chrome extension APIs, so they may need mocking
  */
 
-import { describe, it, before, after } from 'node:test';
+import { describe, it } from 'node:test';
 import assert from 'node:assert';
 
 // Mock chrome.storage for testing. The extension uses two areas: session