ci: make the frontend gates real, and fix the coverage script

The repo configured four frontend gates and enforced one of them. eslint
and prettier ran in no workflow and no hook; `bun run check` ran only in
build-release.yml, so a type error could sit on master until somebody cut
a tag; and `bun run test:coverage` had been dead for months.

CI (build-and-test.yml) now runs format:check, lint, check and coverage
alongside the existing boundary and doc-link tripwires.

The coverage script failure was a version mismatch, not a config problem:
@vitest/coverage-v8 resolved to 4.1.10, whose peer range pins vitest
exactly, while package.json asked for ">=1.0.0 <5.0.0" and got 4.0.16 --
every run died on a missing BaseCoverageProvider export. The loose range
is what allowed the pair to drift, so it is now ^4.1.10.

Two ratchets, same policy as MIN_THRESHOLD in traceability-check.yml:

  eslint  --max-warnings=159   (0 errors; 159 is today's backlog, only
                                ever lower it)
  vitest  thresholds           (statements 51 / branches 45 /
                                functions 46 / lines 52, measured at
                                54.6 / 48.7 / 49.6 / 55.1)

no-console is promoted from "off" to "error": the logger-facade
migration it was waiting on is finished -- 8 calls remained, 2 of them
real stragglers in the settings page, now on the facade the file already
imported. The sink itself, tests, and scripts/ are exempted; a CLI whose
stdout is the product is not a stray debug statement.

The threshold was verified to bite by raising it to 99 and watching the
run go red, not by assuming an unfailed gate works.

DR-205 moves to Done; the coverage gate is DR-215.

scripts/hooks/pre-commit

@@ -12,6 +12,8 @@
 #   bun run check                        svelte-check (types)
 #   bun run test                         vitest, single pass
 #   scripts/check-frontend-boundary.sh   domain-taxonomy tripwire (DR-094)
+#   bun run format:check                 prettier
+#   bun run lint --max-warnings=N        eslint, warning-count ratchet
 #   cargo fmt --all -- --check           only when src-tauri/ is staged
 #
 # NOT here, on purpose: `cargo clippy` and `cargo test`. Both take minutes on a
@@ -59,6 +61,10 @@ run_gate() {
 run_gate "svelte-check (bun run check)" bun run check
 run_gate "frontend tests (bun run test)" bun run test
 run_gate "frontend/backend boundary" bash scripts/check-frontend-boundary.sh
+run_gate "formatting (bun run format:check)" bun run format:check
+# Same ratchet as the CI step in build-and-test.yml — keep the two numbers equal,
+# or a commit passes here and fails there.
+run_gate "lint (bun run lint)" bun run lint --max-warnings=159
 
 # rustfmt only matters when Rust actually changed, and `cargo fmt --check` is
 # cheap (no compilation) whenever it does.