chore(tooling): oxlint + oxfmt frontend, lefthook gate, govulncheck (#21)

- apps/frontend: oxlint 1.85 (typescript/unicorn/oxc — no react rules,
  SolidJS), oxfmt scripts; lint script now oxlint && tsc --noEmit
- backend: gofmt; bump x/text 0.39.0, quic-go 0.59.1, pgx 5.9.2
  (govulncheck 0 reachable vulns, was 3)
- ci: go vet + govulncheck in Go job (frontend job already gates via
  lint:frontend)
- lefthook pre-push: frontend lint + gofmt + vet/test + gitleaks

Authored By: TDvorak <[email protected]>

Generated with [Devin](https://devin.ai)

Co-authored-by: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

lefthook.yml

@@ -0,0 +1,13 @@
+# Pre-push gate — lint + typecheck + format-check + Go checks + secrets.
+# Install once per clone: `lefthook install`
+pre-push:
+  parallel: true
+  commands:
+    frontend-lint:
+      run: npm run lint:frontend
+    gofmt:
+      run: gofmt -l apps/backend | (! grep .)
+    go-checks:
+      run: cd apps/backend && go vet ./... && go test ./...
+    secrets:
+      run: gitleaks git --log-opts="origin/main..HEAD" --redact