ci: add lint workflow, shellcheck fixes, and CI failure hookshot alert

- .gitea/workflows/lint.yml: new workflow running shellcheck on .sh files
  and eslint on hookshot/ JS transform scripts
- hookshot/.eslintrc.json: declare data/result as hookshot globals
- hookshot/ci-alert.js: new Matrix hookshot transform for CI failure alerts
- hookshot/deploy.sh: fix SC2155 (split local/assign), SC2034 (remove unused var)
- systemd/livekit-clear-port.sh: fix SC2148 (invalid shebang escape)
- cinny/dev-update.sh: fix SC2115 (use ${WEB_ROOT:?} to guard rm -rf)
- deploy/lxc151-hookshot.sh: add shellcheck source=/dev/null for sourced file
- .gitignore: ignore node_modules/
- package.json + package-lock.json: eslint@8 dev dependency

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

hookshot/.eslintrc.json

@@ -0,0 +1,14 @@
+{
+    "env": { "es2021": true },
+    "parserOptions": { "ecmaVersion": 2021 },
+    "globals": {
+        "data": "readonly",
+        "result": "writable"
+    },
+    "rules": {
+        "no-unused-vars": "warn",
+        "no-undef": "error",
+        "semi": ["error", "always"],
+        "eqeqeq": "warn"
+    }
+}

hookshot/ci-alert.js

@@ -0,0 +1,7 @@
+// Gitea Actions CI failure alert
+// Receives: { text: "CI FAILED: repo @ branch — url" }
+// Posted by the notify-failure job in each repo's lint.yml
+var msg = data.text || data.body || '';
+var lines = ['🔴 ' + msg];
+var htmlParts = ['🔴 <b>CI Failure</b><br>' + msg.replace(/—\s*(https?:\/\/\S+)/, '— <a href="$1">View Run</a>')];
+result = { version: 'v2', plain: lines.join('\n'), html: htmlParts.join('<br>'), msgtype: 'm.notice' };

hookshot/deploy.sh

@@ -23,13 +23,16 @@ DIR="$(cd "$(dirname "$0")" && pwd)"
 
 deploy_hook() {
     local file="$1"
-    local filename="$(basename "$file" .js)"
+    local filename
+    filename="$(basename "$file" .js)"
     # Capitalize first letter of each hyphen-separated word, preserving hyphens
     # e.g. proxmox -> Proxmox, uptime-kuma -> Uptime-Kuma, tinker-tickets -> Tinker-Tickets
-    local state_key="$(python3 -c "import sys; s='$filename'; print('-'.join(w.capitalize() for w in s.split('-')))")"
-    local fn="$(cat "$file")"
-    local encoded_room="$(python3 -c "import urllib.parse; print(urllib.parse.quote('$MATRIX_ROOM'))")"
-    local encoded_key="$(python3 -c "import urllib.parse; print(urllib.parse.quote('$state_key'))")"
+    local state_key
+    state_key="$(python3 -c "import sys; s='$filename'; print('-'.join(w.capitalize() for w in s.split('-')))")"
+    local encoded_room
+    encoded_room="$(python3 -c "import urllib.parse; print(urllib.parse.quote('$MATRIX_ROOM'))")"
+    local encoded_key
+    encoded_key="$(python3 -c "import urllib.parse; print(urllib.parse.quote('$state_key'))")"
 
     local response
     response=$(curl -sf -X PUT \