ci: freeze the web lint warning cap at zero (batch 5)

The 99-warning legacy backlog from the React 19 / eslint-plugin-react-hooks
v6 upgrade is fully burned down — CI now fails on any new warning. The
compiler rules stay demoted to "warn" so local dev output remains readable;
the eslint config comments now point to the established fix patterns
instead of the retired ratchet.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

.github/workflows/ci.yml

@@ -77,12 +77,11 @@ jobs:
       - name: Typecheck
         run: npx tsc --noEmit
 
-      # Errors fail outright. Warnings are ratcheted: the cap is the current
-      # count of accepted warnings (React-Compiler hooks-rule findings demoted
-      # in eslint.config.mjs + exhaustive-deps) — when you fix warnings, lower
-      # the cap to match; never raise it.
+      # Errors fail outright, and so does ANY warning: the codebase is
+      # warning-clean and must stay that way — fix new findings, never
+      # raise the cap.
       - name: Lint
-        run: npm run lint -- --max-warnings 99
+        run: npm run lint -- --max-warnings 0
 
       - name: Tests
         run: npm test

src/Web/autopilot-monitor-web/eslint.config.mjs

@@ -1,7 +1,7 @@
 // Flat ESLint config (Next 16 removed `next lint`; run via `npm run lint`).
-// CI gates on this: errors fail the web job, warnings are ratcheted via
-// --max-warnings (see .github/workflows/ci.yml) — lower the cap when you fix
-// warnings, never raise it.
+// CI gates on this: errors fail the web job, and the codebase is warning-clean —
+// CI runs with --max-warnings 0 (see .github/workflows/ci.yml), so any new
+// warning fails the build. Fix findings; never raise the cap.
 import nextVitals from "eslint-config-next/core-web-vitals";
 import nextTs from "eslint-config-next/typescript";
 
@@ -20,11 +20,12 @@ const config = [
   ...nextTs,
   {
     // The React-Compiler-powered hooks rules (new in eslint-plugin-react-hooks
-    // v6 via eslint-config-next 16) flag long-standing patterns whose cleanup
-    // is a behavioral refactor per site (auth/SignalR/MSAL-adjacent code), not
-    // a mechanical fix. Kept visible as warnings and burned down incrementally
-    // under the CI warning ratchet; do NOT silence individual sites with
-    // eslint-disable instead of fixing them.
+    // v6 via eslint-config-next 16) are kept at "warn" so local dev output stays
+    // readable, but the legacy backlog is fully burned down and CI's
+    // --max-warnings 0 fails the build on any new finding. Fix new sites with
+    // the established patterns (inner-async wrapper for fetch effects,
+    // derive/adjust-during-render for state sync, useSyncExternalStore for
+    // browser APIs); do NOT silence sites with eslint-disable.
     rules: {
       "react-hooks/set-state-in-effect": "warn",
       "react-hooks/refs": "warn",