chore: no-issue: upgrade eslint to 9

[passcod]

Changes

🤖 Upgrade the root flat-config eslint stack to v9 (eslint, @eslint/js, typescript-eslint v8, eslint-plugin-react-hooks v5, eslint-plugin-markdown v5, eslint-plugin-react 7.37). This clears the deprecated @humanwhocodes/config-array + @humanwhocodes/object-schema and rimraf@3 (via flat-cache) that eslint 8 pulled in (123 packages removed from the lockfile). Also drops the unused @beyondessential/eslint-config-beyondessential + redundant eslint devDeps from settings (no .eslintrc references them — the root flat config already lints those packages).

Config changes the bump required:

• no-unused-vars: eslint 9 changed the caughtErrors default to 'all'; restored the pre-9 behaviour of not flagging unused catch bindings (the TS rule keeps its own pattern).
• Scoped the react-hooks plugin to the React packages (web, ui-components, patient-portal, mobile). react-hooks v5's rules-of-hooks otherwise false-positives on any use() call — e.g. Playwright's use fixtures in e2e-tests, or Sequelize.useCLS() in the database package (whose now-obsolete eslint-disable was removed). The react plugin stays repo-wide (its rules only act on JSX, which also appears in non-app packages like the react-pdf certificates in shared).
• packages/database/src/models/Setting.ts: replaced a runtime const … = Object.values(SETTINGS_SCOPES) that was only ever used in type position with a pure type alias (ts-eslint v8 correctly flagged the dead runtime value).

npm run lint-all passes with 0 errors.

Stacked on #10069 (Node 24).

Auto-Deploy

• Deploy

Options

• Synthetic test
• Generate fake data
• More data (20Gi)
• No facility servers (central-only)
• No sync (facility tasks scaled to zero)
• AMD64 architecture (default is arm64)
• Skip mobile build
• Always build mobile
• Stay up for 8 hours
• Stay up for 24 hours
• Stay up (no TTL)
• Build images only (don't deploy)
• Pause this deploy

Tests

• Run E2E tests
• Run DAST scan

Review Hero

• Run Review Hero
• Auto-fix review suggestions Wait for Review Hero to finish, resolve any comments you disagree with or want to fix manually, then check this to auto-fix the rest.
• Auto-fix CI failures Check this to auto-fix lint errors, test failures, and other CI issues.
• Auto-merge upstream Check this to merge the base branch into this PR, with AI conflict resolution if needed.
• Save suppressions Check this to capture 👎 reactions on Review Hero comments as suppression rules in .github/review-hero/suppressions.yml. Also runs automatically at the end of any auto-fix run.

Remember to...

• ...write or update tests
• ...add UI screenshots and testing notes to the Linear issue
• ...add any manual upgrade steps to the Linear issue
• ...update the config reference, settings reference, or any relevant runbook(s)
• ...call out additions or changes to config files for the deployment team to take note of

[review-hero]

🦸 Review Hero Summary
3 agents reviewed this PR | 0 critical | 1 suggestion | 0 nitpicks | Filtering: consensus 3 voters

Local fix prompt (copy to your coding agent)

Fix these issues identified on the pull request. One commit per issue fixed.

---

eslint.config.js:62: The comment on the base no-unused-vars rule says "the TS config opts in via its own pattern" — implying TypeScript files would still flag unused catch bindings. But the TS override at line 102 was also changed to caughtErrors: 'none', which means unused catch bindings are silently ignored in TypeScript files too. The comment is misleading and the behaviour change appears unintentional: to match the stated intent, the TS override should keep caughtErrorsIgnorePattern: '^_' instead of caughtErrors: 'none', so that catch bindings prefixed with _ are allowed but others are still caught.

[review-hero]

🦸 Review Hero Summary
3 agents reviewed this PR | 0 critical | 0 suggestions | 0 nitpicks | Filtering: consensus 3 voters, 1 below threshold

No issues found. Looks good!

Below consensus threshold (1 unique issue not confirmed by majority)

Location	Agent	Severity	Comment
eslint.config.js:66	Bugs & Correctness	nitpick	The comment says 'the TS config opts in via its own pattern', implying the TypeScript block is stricter about catch errors (e.g. allowing only _-prefixed bindings). But the TS block at line 116 w...