refactor(frontend): lint, one session guard, one request helper, one user context

README.md

@@ -99,7 +99,8 @@ To Be Played is split into three repositories:
 - Vitest + React Testing Library + jsdom
 - Production image: nginx (Alpine), SPA fallback, long-term caching for hashed assets, Content Security Policy
   and security headers
-- CI: Forgejo Actions (`npm ci`, `npm test`, `npm run build`, Docker image)
+- ESLint with the React hooks rules (`npm run lint`)
+- CI: Forgejo Actions (`npm ci`, `npm run lint`, `npm test`, `npm run build`, Docker image)
 
 ## Architecture
 
@@ -127,8 +128,14 @@ flowchart LR
 - Calls for the logged-in user go through `src/utils/api.js`. `clientFetch` sends the HttpOnly cookies and the
   `X-TBP-Client` header. `apiFetch` answers a `401` with one `POST /api/auth/refresh` and sends the request again.
   Parallel requests and other tabs share this refresh (`navigator.locks`). When the second answer is still a
-  `401`, the page calls `useSessionExpired`, which opens the login page. Public pages (landing page, public
-  profile) and the public `GET /api/version` in the settings use plain `fetch`.
+  `401`, `apiFetch` fires `expired`; the pages only stop. `request()` wraps `apiFetch` as `{ok, status, data}`
+  and never throws. Public pages (landing page, public profile) and the public `GET /api/version` in the settings
+  use plain `fetch`.
+- The pages that need a login sit under the `RequireSession` layout route in `App.jsx`. Without a session it opens
+  the login page, which comes back to the same page; on `expired` it ends the session (`useSessionExpired`). A
+  `401` on a public page ends nothing.
+- `CurrentUserProvider` holds `GET /api/users/me` for the whole app (`useCurrentUserContext`, `useCurrentUser`).
+  Dashboard and settings load it again when they open.
 - `src/utils/brokenImages.js` reports pictures that fail to load (`GameCover`, achievement icons on the game
   detail page) to Core.
 - `useLibrarySync` polls Core's `/api/library/sync-status` while a Steam sync runs, then loads the data again.
@@ -191,6 +198,7 @@ browser bundle, so they must never hold a secret.
 ## Tests and build
 
 ```bash
+npm run lint
 npm test
 npm run build
 ```