Clear GitRoll reliability findings and add type-aware lint

.github/workflows/typescript.yml

@@ -0,0 +1,46 @@
+name: TypeScript lint
+
+on:
+  push:
+    branches:
+      - master
+      - main
+    paths:
+      - "web/**/*.ts"
+      - "web/tsconfig.json"
+      - "web/package.json"
+      - "web/package-lock.json"
+      - "package.json"
+      - "package-lock.json"
+      - "eslint.config.mjs"
+      - ".github/workflows/typescript.yml"
+  pull_request:
+    paths:
+      - "web/**/*.ts"
+      - "web/tsconfig.json"
+      - "web/package.json"
+      - "web/package-lock.json"
+      - "package.json"
+      - "package-lock.json"
+      - "eslint.config.mjs"
+      - ".github/workflows/typescript.yml"
+
+permissions:
+  contents: read
+
+jobs:
+  lint:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: "22"
+          cache: npm
+          cache-dependency-path: |
+            package-lock.json
+            web/package-lock.json
+      - run: npm ci
+      - run: npm ci
+        working-directory: web
+      - run: npm run lint

eslint.config.mjs

@@ -0,0 +1,32 @@
+import tseslint from "typescript-eslint";
+
+const typeAware = {
+  languageOptions: {
+    parser: tseslint.parser,
+    parserOptions: {
+      project: ["./web/tsconfig.json"],
+      tsconfigRootDir: import.meta.dirname,
+    },
+  },
+  plugins: { "@typescript-eslint": tseslint.plugin },
+};
+
+export default tseslint.config(
+  {
+    ignores: ["web/.astro/**", "web/dist/**"],
+  },
+  {
+    files: ["web/**/*.ts"],
+    ...typeAware,
+    rules: {
+      "@typescript-eslint/no-unnecessary-type-assertion": "error",
+    },
+  },
+  {
+    files: ["web/**/*.tsx"],
+    ...typeAware,
+    rules: {
+      "@typescript-eslint/prefer-readonly-parameter-types": ["error", { ignoreInferredTypes: true }],
+    },
+  }
+);