chore: quality-tightening (oxfmt + oxlint + tsgo + vitest + husky + CI)

[webbertakken]

Standard rollout for this Tauri + React + Konva map editor. Was missing oxfmt/oxlint/tsgo/vitest/husky and had no JS-side CI (only the rust ci.yml). Repo had 0 tests before.

• new: prettier-style formatting via oxfmt (no prior config)
• new: oxlint with eslint-plugin-unicorn + react + jsx-a11y
• new: vitest 3 + @vitest/coverage-istanbul + happy-dom + @testing-library/react + @testing-library/jest-dom. 14 unit tests covering AssetPath (3 static helpers, edge cases for slashes and prefix stripping) and createObservable (notify fan-out, unsubscribe, Object.isFrozen invariant).
• new: tsgo --noEmit (alongside tsc fallback). step-rust-build now uses tsgo too.
• new: husky 9 with scripts/ensure-husky.mjs self-heal + lint-staged. Pre-commit additionally runs cargo check on staged Rust/Cargo files (Tauri convention from the playbook).
• new: .github/workflows/checks.yml runs Format + Lint + Typecheck + Test on every PR + push.
• new: gitleaks, actionlint, shellcheck as mise-managed binaries.

Action version updates surfaced by actionlint

• actions/checkout@v2/@v3 \u2192 @v4 (15 instances across ci.yml + release.yml)
• actions-rs/toolchain@v1 \u2192 dtolnay/rust-toolchain@stable (the actions-rs/* org is archived)
• actions-rs/cargo@v1 \u2192 plain run: cargo \u2026 shell commands

Code-level oxlint fixes

• Removed unused imports (HTMLInputTypeAttribute, isSceneOpenState, Transformer).
• Prefixed unused parameters with _ (ExternalLink href, Canvas e, CanvasSprite e/onTransformEnd e).
• Dropped unused get destructure in SceneState recoil setter.
• useGlobalHotkeys: rewrote a ? x() : y() as if/else (clearer + no-unused-expressions clean).
• Modal subtitle ref binding: documented the no-op-looking declaration with an eslint-disable comment (it's set later by react-modal via a callback ref).
• Yarn resolutions pin @types/react and @types/react-dom to ^18 to avoid @types/react-modal pulling @types/react@19 transitively (which broke the JSX namespace).

Carve-outs

• src/init.ts polyfills String.prototype.capitaliseFirstLetter; the no-extend-native rule is disabled for that one file.
• 13 pre-existing oxlint warnings remain (oxc/no-map-spread, react-hooks/exhaustive-deps where the deps are stable refs, plus jsx-a11y warnings on the canvas overlay). Per playbook trap feat: quality of life updates #22 the lint script drops --deny-warnings.

Verified locally

• yarn lint \u2014 0 errors, 13 warnings
• yarn format:check \u2014 clean
• yarn typecheck \u2014 clean
• yarn test \u2014 14 / 14
• actionlint \u2014 clean across all 3 workflows