web: upgrade ESLint to v9 with flat config

[kevinortiz43]

Migrates app/web from ESLint 8 (legacy .eslintrc.json) to ESLint 9 with the new flat config (eslint.config.mjs). This is the prerequisite for upgrading to Next.js 16, which requires ESLint 9 + flat config.

Done as 4 incremental, individually-validated commits at major-change boundaries: pin 8.57.1 → migrate to flat config on 8.57 → ESLint 9.0.0 → latest 9.x (9.39.4). eslint-config-next 15.5.7 is legacy-format only, so next/core-web-vitals is loaded via FlatCompat (@eslint/eslintrc); native flat exports are a follow-up coupled to the Next 16 bump. The flat config is a 1:1 translation of the old .eslintrc.json (same plugins, same rule severities, proto/** ignore preserved).

Closes #7383

Migration guides followed

• Official ESLint Migrate to v9.x guide (linked from the issue) — flat config as default, --ext / .eslintignore removal, the removed-API checklist.
• Next.js ESLint flat-config docs — the FlatCompat (@eslint/eslintrc) pattern for loading next/core-web-vitals, since eslint-config-next 15.x ships only the legacy config format.

Testing

Lint parity was the primary gate at every stage (repo is at zero warnings, so a config that lints nothing would also pass CI — parity was verified explicitly, not just "lint passes"):

• File-inventory diff (old vs new config) empty at every stage — same set of files linted, JSON included.
• eslint --print-config rule-map diff empty on 5 representative files (feature .tsx, .test.tsx, a .js script, a locale .json, package.json).
• Seeded-violation smoke: unused import, unsorted imports, duplicate JSON key each still fire; @next/next/no-img-element / jsonc/no-comments stay off — identical ruleset old vs new.
• yarn lint --max-warnings=0 green at all 4 stages.
• yarn format idempotent, tsc --noEmit passes, full yarn test suite: zero regressions (only pre-existing parallel-load flakes).
• yarn build (production) passes, no rushstack/eslint stack traces.
• Playwright smoke (landing, login, dashboard at desktop 1280px + mobile 375px): renders correctly, 0 console errors.

Note: no runtime/UI code changed — this is a lint-toolchain migration, so the browser smoke was a sanity check rather than a UI review.

Web frontend checklist

• There are no console warnings when running the app
• Added tests where relevant (N/A — lint-toolchain change, no test files touched)
• Clicked around my changes running locally and it works
• Checked Desktop, Mobile and Tablet screen sizes (desktop + mobile smoke only; no UI diff to check)

For maintainers

• Maintainers can push commits to my branch
• Maintainers can merge this PR for me

This PR was created with the Couchers PR skill.

[CouchersBot]

Mobile

Install the Dev Tool (iOS via TestFlight, iOS Simulator, or Android .apk) here.

Scan the QR with your phone camera, or tap Open in Dev Tool on the device, to open this branch in the installed Dev Tool dev client.

iOS	Android
Open in Dev Tool	Open in Dev Tool

Deep links

iOS

couchers-devtool://expo-development-client/?url=https%3A%2F%2F3e321da2--ota.preview.couchershq.org%2Fios%2Fmanifest

Android

couchers-devtool://expo-development-client/?url=https%3A%2F%2F3e321da2--ota.preview.couchershq.org%2Fandroid%2Fmanifest

Web (Vercel)

View the Vercel web preview for this branch.

Backend

Schema	Schema diff	Sample emails

Other

Protos	Backend coverage	Web coverage

[nabramow]

Hey @kevinortiz43 just checking did you follow the migration guide for this? If so can you please link it in the description?

[kevinortiz43]

@nabramow You are right I did not include the migrations guides, I have included it now.

[nabramow]

@kevinortiz43 I noticed this is marked as a draft, but you also marked me as a reviewer. Are you still working on it or is it ready for review?

[kevinortiz43]

@nabramow yes please review! I was scared about this one and wanted the CI/CD pipeline to go green then check out vercel and make sure everything worked fine before asking for a review.

[kevinortiz43]

alright the vercel preview looks good

[nabramow]

Okay this looks good to go now! Thanks for picking this up!

[github-actions]

📝 Release Notes

This PR does not need to be included in release notes.

Reason: This PR is a developer tooling upgrade for ESLint configuration in the web app. It does not change user-facing behavior or fix a noticeable end-user issue, and while it helps enable a future Next.js upgrade, on its own it is routine internal technical work rather than a major infrastructure change users would care about.

🤖 Bot Debug Information

Model: couchers.openai.gpt-5.4
Decision: exclude
Reasoning: This PR is a developer tooling upgrade for ESLint configuration in the web app. It does not change user-facing behavior or fix a noticeable end-user issue, and while it helps enable a future Next.js upgrade, on its own it is routine internal technical work rather than a major infrastructure change users would care about.