Stand up ESLint with a TypeScript + react-hooks baseline

[finnar-bin]

Summary

• Adds ESLint via flat config (eslint.config.js) with typescript-eslint's recommended config and eslint-plugin-react-hooks's recommended config against src/**/*.{ts,tsx}, plus an npm run lint script.
• Fixes the ~30 scattered findings outside theme/**/LegacyTheme/** (dead imports/args in .stories.tsx files, unused vars, let→const, etc.).
• Types the ~56 theme: any params in src/theme/index.tsx as MUI's Theme (parameterizing components as Components<Omit<Theme, "components">> so this type-checks), which also surfaced and fixed a real gap: body3 was only augmented on TypographyVariantsOptions (createTheme input) and never on TypographyVariants (what theme.typography.body3 reads at runtime). One remaining any (MuiAutocomplete.inputRoot's ownerState) can't be typed — MUI's AutocompleteOwnerState generics don't unify against the untyped styleOverrides slot — so it's a scoped inline disable instead. Net effect: the directory-wide no-explicit-any → warn override called for in the issue is no longer needed and has been removed; no-explicit-any is back to error repo-wide.
• Triages the four items called out in the issue:
  • ConfirmDialog/index.tsx — the unused onClose destructure was a real bug silently stripping onClose before it reached MUI's Dialog, so backdrop/Escape-driven close never fired. Fixed.
  • FieldTypeSort/index.tsx — the two onChange && onChange(...) were functionally fine, just an unused-expression lint shape; rewritten as onChange?.(...).
  • SSOButtonGroup/index.tsx — the exhaustive-deps warning is not a bug: adding the missing deps would re-fire onSuccess/onError on every parent re-render for unmemoized callbacks. Left as-is with a justified inline disable.
  • utils/useSSO.ts — genuine stale-closure bug: the message listener closed over authServiceUrl but only ran on mount, so a changed authServiceUrl after mount kept validating against the stale origin. Fixed with useCallback.
• LegacyTheme/index.ts's file-wide @ts-nocheck gets a scoped, justified disable instead of being left as a raw finding.
• Pins Node via volta/.nvmrc to 18.20.4 — needed for ESLint 9's structuredClone requirement, while keeping Storybook 6/webpack 4 working via NODE_OPTIONS=--openssl-legacy-provider on the storybook/build-storybook scripts specifically (rather than a project-wide Node downgrade).

Out of scope (per issue)

• CI wiring — deferred to a separate ticket.
• Formatting/Prettier rules.
• Any rule beyond the two named recommended configs.

Test plan

• npm run lint exits 0 (0 errors, 0 warnings)
• tsc --noEmit -p tsconfig.json exits 0
• Manually verified in Storybook: ConfirmDialog now closes on backdrop click/Escape; other touched stories render without console errors
• Built and imported into manager-ui — works as expected

Closes #128

🤖 Generated with Claude Code

[github-actions]

Code Review — ✅ No blockers

[github-actions]

Code Review — ✅ No blockers