Add ESLint gate, actions/redact unit tests; fix README release drift.

- README Release section now matches CI reality: tag push publishes to the
  Gitea npm registry AND creates the Gitea release (was described as
  visibility-only, predating the npm publish step).
- ESLint flat config (eslint + typescript-eslint recommended); `npm run lint`
  is now eslint (typecheck stays separate) and CI build-and-test gates on it.
  One real finding fixed: dead import in src/mail/index.ts.
- New vitest coverage for the previously untested src/browser/actions.ts
  (click/fill retries, safeGoto, waitForUrlHost, assertPublicHost, BasePage
  URL building) and src/logging/redact.ts (redactSecrets).

package.json

@@ -48,7 +48,7 @@
     "test": "vitest run",
     "test:watch": "vitest",
     "selftest": "playwright test -c selftest/playwright.config.ts",
-    "lint": "tsc --noEmit",
+    "lint": "eslint src",
     "prepublishOnly": "npm run build",
     "example:api": "tsx examples/api/health.example.ts"
   },
@@ -64,11 +64,15 @@
     }
   },
   "devDependencies": {
+    "@eslint/js": "^10.0.1",
     "@playwright/test": "1.61.1",
     "@types/node": "^22.15.0",
+    "eslint": "^10.8.0",
+    "globals": "^17.8.0",
     "tsup": "^8.4.0",
     "tsx": "^4.19.0",
     "typescript": "^5.8.0",
+    "typescript-eslint": "^8.65.0",
     "vitest": "^3.1.0"
   },
   "engines": {