feat(review): add local ESLint checks to code review

[leoreisdias]

Context

Code review currently shows the diff, but it cannot surface project-specific ESLint feedback such as Rules of Hooks violations or missing useEffect dependencies. Reviewers have to leave Plannotator and run ESLint separately, which makes these findings easy to miss.

This adds an explicit ESLint check for local reviews. Plannotator uses the reviewed project's existing configuration, plugins, and project-local ESLint installation. It does not install dependencies, invoke package scripts, or use a bundled/global ESLint.

What changed

• Adds an ESLint entry to the review navigation when supported changed files have both a discoverable configuration and project-local ESLint.
• Shows a one-time consent dialog before executing project configuration and plugins with the user's permissions.
• Runs ESLint only against supported files present in the active local review and renders structured errors and warnings in a dedicated review panel.
• Highlights findings on changed lines by default, with an option to inspect all findings in the changed files.
• Opens the corresponding diff and line when a finding is selected.
• Supports ordinary local working-tree reviews and nested workspace reviews in both Bun and Pi runtimes.
• Intentionally keeps GitHub/GitLab URL reviews unavailable for now, avoiding an implicit dependency installation or large temporary node_modules checkout.

Safety and review focus

The important areas to review are:

1. Execution boundary: packages/shared/eslint-check.ts resolves only project-local ESLint entrypoints, passes file paths as argv without a shell, caps files/output, and shares one 30-second budget across config groups.
2. Snapshot integrity: both review servers validate the active snapshot and VCS fingerprint before using cached results and again after ESLint finishes.
3. Runtime parity: the Bun and Pi endpoints advertise availability and return the same response shapes.
4. Consent copy: the UI does not promise that third-party ESLint configuration or plugins are side-effect free.

Video

export-1785303880373.mp4

Verification

• Shared ESLint runner tests, including changed-line mapping, workspace paths, local package resolution, timeout/output limits, and request-wide timeout budgeting
• Bun review endpoint regression tests
• Pi review endpoint regression tests
• All TypeScript project configurations checked with tsc --noEmit
• Review, hook, and Pi production builds
• git diff --check
• Plannotator manual review completed with no changes requested

The full suite reached 2,205 passing tests with 99 skipped. One unrelated Bun API 404 guard exceeded its five-second timeout under full-suite load and passed immediately when rerun in isolation.