chore: type-aware lint, and the four things it found

[cport1]

Closes #738.

Four type-aware rules on src (not tests): no-floating-promises, no-misused-promises, await-thenable, require-await.

The broad recommendedTypeChecked preset is deliberately not used. Most of it duplicates what strict already enforces, at the cost of a much slower lint and a large backlog of findings that are style rather than defects. These four catch things tsc cannot.

It found five errors. One is a bug, two are traps, two are fine and now say so.

The bug: express/captcha.ts hung on any throw

return async (req, res, next): Promise<void> => {
  const result = await endpoints.handle({ ... });

Express 4 does not catch a rejected promise from a handler. Anything thrown inside endpoints.handle() — crypto, JSON parsing, a store access — left the request hanging until the client timed out, and logged an unhandled rejection instead of returning a 500. Now synchronous, with the rejection routed to next() explicitly.

The trap: an async submit listener

document.addEventListener('submit', async (e) => {
  ...
  e.preventDefault();
  const result = await this.execute(...);

This worked — preventDefault() is reached before the first await, so the cancel lands. But it only works for that reason, and it was one added await above line 124 away from silently breaking every protected form: once the handler yields, the browser has already submitted and cancelling is a no-op. Nothing in the test suite would have caught it.

The listener is now synchronous and the async half is its own method, kicked off with void after the cancel. The invariant is in a comment rather than in someone's memory.

The trap: a floating audioCtx.close()

Inside a try whose catch does not cover it — the promise escapes the block, so a rejection surfaced as an unhandled rejection in the user's console. void alone wouldn't fix that; it needs the .catch().

The two that were fine

violation-reporter's flush timer (flush catches everything internally and never rejects) and the fastify plugin's async signature (that's the plugin contract). Both now carry a void/disable and a sentence saying why, so they read as decisions rather than oversights. A timer whose callback rejects keeps firing and adds an unhandled rejection every tick — worth stating even when it isn't happening.

Verification

0 errors across all six packages. Warning budgets unchanged (9/25/10/0/2/0). 446 tests pass. Lint runtime went from ~0.5s to ~4s for the whole workspace, which is why the rule set stays small.