chore: fix CI — replace ESLint with Biome, unbreak fastify 5 and native builds

[fey]

Node CI has been red on main since 12.03.2026. #91 is not the cause — it only bumps action versions and the base image. The breakage came from #89 (e3413d7), which bumped several things at once, and CI never got past the first failing step, so the later ones stayed hidden.

Four problems, found one at a time by pushing the pipeline forward:

1. make setup — ERESOLVE

eslint went ^8.22.0 → ^10.0.3 while eslint-config-airbnb-base@15 declares peer eslint@"^7.32.0 || ^8.2.0".

npm error Could not resolve dependency:
npm error peer eslint@"^7.32.0 || ^8.2.0" from eslint-config-airbnb-base@15.0.0

airbnb-base has no flat-config support and ESLint 10 dropped .eslintrc.* entirely, so there is no in-place upgrade. Replaced with Biome 2.5.6 — one native binary, no peer dependencies, covers both the linter and the style rules airbnb-base used to provide.

• .eslintrc.yml, .eslintignore → biome.json
• make lint → npx biome ci ., plus npm run lint / npm run lint:fix
• 18 findings fixed: node: protocol on builtin imports, unused handler params, a forEach callback that returned a value, @ts-ignore → @ts-expect-error, optional chaining
• formatter applied in its own commit (11 files, no behaviour change)

The relaxations from .eslintrc.yml (no-console, import/extensions, new-cap, no-param-reassign, no-underscore-dangle) were all loosenings of airbnb rules that have no counterpart in Biome's recommended set, so nothing was carried over.

2. make setup — native build failure

fastify-objectionjs declares better-sqlite3 as a peer dependency, so npm installs it even though nothing imports it. The resolved 8.7.0 has no prebuilds for Node 24, fell back to a source build and failed against the V8 headers. Pinned to ^13 via overrides.

3. make test — all 6 tests failed

The same bump moved fastify 4 → 5:

FastifyError: The fastify-method-override plugin being registered mixes async and callback styles.

fastify-method-override@1.5.10 (last release Feb 2023) is declared async (fastify, opts, next) and calls next(). Fastify 4 tolerated it, Fastify 5 rejects it. The package is unmaintained and there is no maintained fastify-native replacement, so server/lib/methodOverride.js calls it directly with a no-op next and re-wraps it in fastify-plugin to keep its onRoute hook and setNotFoundHandler on the parent instance.

The _method override is load-bearing — the sign-out button POSTs _method=delete to reach DELETE /session. Verified that route is reached again.

4. Runtime, outside CI — left to #91

The built image crashes on start:

libm.so.6: version `GLIBC_2.38' not found (required by /app/node_modules/sqlite3/build/Release/node_sqlite3.node)

sqlite3@6's prebuild needs glibc 2.38, and node:25-slim is bookworm (glibc 2.36). node:26-slim is trixie (glibc 2.41) — exactly the bump #91 makes, so this is not fixed here. The deploy job only builds and pushes the image, so it stays green either way.

Verification

Full pipeline from a clean tree, matching CI:

make setup	ok
make lint	ok — 0 findings
make test	ok — 3 suites, 6 tests
make build	ok
docker build on node:25-slim	ok
container on node:25-slim	✗ glibc 2.38 (problem 4)
container on node:26-slim	ok — GET / and GET /users → 200

Merge order

Merge this, then @dependabot rebase on #91 and merge that — #91 goes green and its node:26-slim bump fixes problem 4.

🤖 Generated with Claude Code