chore(tooling): oxlint + oxfmt frontend, lefthook gate, govulncheck (#21)

- apps/frontend: oxlint 1.85 (typescript/unicorn/oxc — no react rules,
  SolidJS), oxfmt scripts; lint script now oxlint && tsc --noEmit
- backend: gofmt; bump x/text 0.39.0, quic-go 0.59.1, pgx 5.9.2
  (govulncheck 0 reachable vulns, was 3)
- ci: go vet + govulncheck in Go job (frontend job already gates via
  lint:frontend)
- lefthook pre-push: frontend lint + gofmt + vet/test + gitleaks

Authored By: TDvorak <[email protected]>

Generated with [Devin](https://devin.ai)

Co-authored-by: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

apps/backend/internal/bookings/service_test.go

@@ -286,11 +286,11 @@ func TestAvailabilityHonorsTenantWideBlockedDay(t *testing.T) {
 		t.Fatalf("parse day: %v", err)
 	}
 	if _, err := repo.CreateBlockedDay(context.Background(), db.CreateBlockedDayParams{
-		TenantID:  "5d6b3551-0a3e-4b86-bdf0-e9df20a47148",
-		StartsAt:  dayStart.UTC(),
-		EndsAt:    dayStart.Add(26 * time.Hour).UTC(),
-		Kind:      "blocked",
-		Reason:    "holiday",
+		TenantID: "5d6b3551-0a3e-4b86-bdf0-e9df20a47148",
+		StartsAt: dayStart.UTC(),
+		EndsAt:   dayStart.Add(26 * time.Hour).UTC(),
+		Kind:     "blocked",
+		Reason:   "holiday",
 	}); err != nil {
 		t.Fatalf("create blocked day: %v", err)
 	}
@@ -709,16 +709,16 @@ func TestCreateArmsSmsReminderWhenEnabled(t *testing.T) {
 		}
 	}
 	resp, err := service.Create(ctx, domain.CreateBookingRequest{
-		TenantSlug:     "studio-atelier",
-		BookingMode:    "appointment",
-		ServiceID:      slot.ServiceID,
-		StaffID:        slot.StaffID,
-		LocationID:     slot.LocationID,
-		CustomerName:   "SMS Test",
-		CustomerEmail:  "[email protected]",
-		CustomerPhone:  "+420777123456",
-		StartsAt:       slot.StartsAt,
-		EndsAt:         slot.EndsAt,
+		TenantSlug:    "studio-atelier",
+		BookingMode:   "appointment",
+		ServiceID:     slot.ServiceID,
+		StaffID:       slot.StaffID,
+		LocationID:    slot.LocationID,
+		CustomerName:  "SMS Test",
+		CustomerEmail: "[email protected]",
+		CustomerPhone: "+420777123456",
+		StartsAt:      slot.StartsAt,
+		EndsAt:        slot.EndsAt,
 	})
 	if err != nil {
 		t.Fatalf("create: %v", err)
@@ -830,9 +830,9 @@ func TestStaffMetricsAggregatesPerStaff(t *testing.T) {
 	}
 
 	seed(-5, "confirmed", true)
-	seed(-3, "confirmed", true)   // already ended → completed too
-	seed(-2, "cancelled", false)  // cancelled → no revenue
-	seed(-40, "confirmed", true)  // outside the 30-day window
+	seed(-3, "confirmed", true)  // already ended → completed too
+	seed(-2, "cancelled", false) // cancelled → no revenue
+	seed(-40, "confirmed", true) // outside the 30-day window
 	// Class booking (no staff) must not appear in per-staff metrics.
 	sessionID := "4bf74c12-44dd-45ca-86bb-b104f16f2435"
 	if _, err := repo.CreateBooking(ctx, db.CreateBookingParams{

apps/backend/internal/config/config_test.go

@@ -4,8 +4,8 @@ import "testing"
 
 func TestStripeCheckoutConfigured(t *testing.T) {
 	cfg := Config{
-		StripeAPIKey:     "sk_test_123",
-		StripeWebhookKey: "whsec_test_123",
+		StripeAPIKey:     "sk_test_123",    // gitleaks:allow — test fixture, not a real key
+		StripeWebhookKey: "whsec_test_123", // gitleaks:allow — test fixture, not a real key
 		StripePriceMatrix: map[string]map[string]string{
 			"starter":  {"czk": "price_starter_czk", "usd": "price_starter_usd"},
 			"pro":      {"czk": "price_pro_czk", "usd": "price_pro_usd"},

apps/backend/internal/export/service_test.go

@@ -152,7 +152,6 @@ func TestExportRequiresMembership(t *testing.T) {
 	}
 }
 
-
 func TestWriteStaffReportCSV(t *testing.T) {
 	repo := db.NewMemoryRepository()
 	serviceID := "d5d76a61-3d49-467c-8dd4-bf61ee754e39"