Follow-up from PR #297 clawpatch review.

web/package.json exposes npm run lint as eslint ., but eslint is not declared in this package. A clean install can fail unless eslint is globally installed or hoisted externally.

Scope:

• Add eslint and the relevant Next/React/TypeScript lint config dependencies, or replace/remove the lint script.
• Update package-lock from a clean install.
• Add a CI/script smoke check if we keep lint.