Harden CI and close tooling gaps from code review

[WillSams]

CI / tooling:

• Stop auto-merging major-version Dependabot updates (patch/minor only)
• Replace git add . in pre-commit with git update-index --again so formatter fixes are re-staged without sweeping in unrelated changes
• Anchor the branch-name regex, add the ci/ prefix, fix the garbled help text, and fix the latent branchName/currentBranch mismatch

Backend type checking:

• Fix the escaped-quote find pattern in lint.sh that matched zero files, making mypy a silent no-op; it now checks all 15 source files
• Add mypy to requirements and a mypy.ini scoping ignore_missing_imports to untyped libs (jose, asyncpg)
• Add a mypy type-check step to the backend CI job
• Fix the type errors mypy surfaced once it actually ran:
  • resolvers: stop reusing the deleted error binding in the fallback except blocks (also removes double-prefixed log messages)
  • data.py: correct fetch_room return annotation (Dict, not Room)
  • graphql.py: decode Response body via bytes() and drop the rebinding
  • about.py: annotate data as Dict[str, Any] for the error path

Frontend eslint 9 migration:

• Port the legacy .eslintrc to a flat eslint.config.mjs (js recommended, react jsx-runtime, eslint-comments rules, browser globals, custom rules)
• Remove obsolete .eslintrc and .eslintignore, resolving the "Could not find config file" error from vite-plugin-eslint under eslint 9