ci(workflow): add eslint config and dedicated lint job

[boluxx123]

Overview

This PR adds an ESLint configuration to the repository and wires it into CI with a dedicated lint job, so lint rules are actually enforced on every pull request instead of living as unenforced preferences.

Related Issue

Changes

🧹 ESLint Configuration

• [ADD] eslint.config.js
  • Flat config using typescript-eslint's recommended rules.
  • @typescript-eslint/no-explicit-any set to warn.
  • no-console set to warn for src/**, with overrides for src/config/ and src/services/observability.service.ts.

📦 Scripts

• [MODIFY] package.json
  • Added a lint script so npm run lint runs ESLint against the tree.
• [MODIFY] package-lock.json
  • Lockfile updated for the added ESLint / typescript-eslint dependencies.

⚙️ CI

• [MODIFY] .github/workflows/ci.yml
  • Added a lint job that runs on pull_request, installs with npm ci, runs npx prisma generate, then npm run lint.
  • Job declares permissions: contents: read and sets timeout-minutes: 15.
  • Every uses: action is pinned to a commit SHA.

Verification Results

npm run lint
✅ exits zero on the current tree

npm test
✅ passes locally

Acceptance Criteria	Status
eslint.config.js exists and npm run lint exits zero on the current tree	✅ Config added; lint passes on current tree
New lint job runs on pull_request and declares permissions: contents: read	✅ Job added with pull_request trigger and read-only permissions
Job sets timeout-minutes and pins every uses: action to a commit SHA	✅ timeout-minutes: 15; actions pinned to SHAs
npm test passes locally	✅ Verified locally

Closes #52