npm run lint never fails on warnings #303

Problem

npm run lint is eslint ., which exits 0 on warnings. The Code Quality workflow (.github/workflows/quality.yml:33) is therefore green with 15 outstanding warnings, and nothing stops more from accumulating.

Breakdown of the 15

• 9 — @typescript-eslint/no-unused-expressions in cypress/e2e/*.cy.ts. False positives: chai assertions (expect(x).to.be.true) are expressions by design.
• 5 — genuinely unused variables:
  • app/login/forgot-password/ForgotPasswordForm.tsx:12 — requestedAt state is set but never rendered. The requestedAt field of the API response is the intentional oracle for the challenge (token = MD5(email + timestamp)) and must stay in app/api/auth/forgot-password/route.ts — only the dead client state goes.
  • tests/api/aes-cbc-padding-oracle.test.ts:154 — data
  • tests/api/open-redirect.test.ts:4 — extractAuthTokenFromHeaders
  • tests/unit/share-crypto.test.ts:2 — crypto, and :55 — iv
• 1 — @next/next/no-img-element at app/products/[id]/ProductDetailClient.tsx:177. Deliberate: an <img> fallback inside <object> for user-uploaded SVGs, which next/image cannot serve without dangerouslyAllowSVG. Same pattern as app/admin/products/ProductsManagementClient.tsx, which already carries an eslint-disable-next-line comment.

Fix

1. eslint.config.mjs — add to the existing tests/** + cypress/** override block (line 33): "@typescript-eslint/no-unused-expressions": "off"
2. Delete the 5 unused variables.
3. Add the // eslint-disable-next-line @next/next/no-img-element comment on ProductDetailClient.tsx:177.
4. package.json — "lint": "eslint . --max-warnings=0"

Can be split into two PRs (cleanup, then the flag) if preferred.

Acceptance

npx eslint . reports 0 problems, and introducing an unused variable fails CI.