Add ESLint gate, actions/redact unit tests; fix README release drift.

- README Release section now matches CI reality: tag push publishes to the
  Gitea npm registry AND creates the Gitea release (was described as
  visibility-only, predating the npm publish step).
- ESLint flat config (eslint + typescript-eslint recommended); `npm run lint`
  is now eslint (typecheck stays separate) and CI build-and-test gates on it.
  One real finding fixed: dead import in src/mail/index.ts.
- New vitest coverage for the previously untested src/browser/actions.ts
  (click/fill retries, safeGoto, waitForUrlHost, assertPublicHost, BasePage
  URL building) and src/logging/redact.ts (redactSecrets).

.gitea/workflows/ci.yml

@@ -40,6 +40,8 @@ jobs:
         run: npm ci
       - name: Typecheck
         run: npm run typecheck
+      - name: Lint
+        run: npm run lint
       - name: Unit tests
         run: npm test
       - name: Build