chore: add ESLint with security plugin, fix code quality warnings

- Install eslint, typescript-eslint, eslint-plugin-security
- Add eslint.config.mjs with project-tuned rules
- Fix redundant catch assignment in cutVideo
- Fix let→const for promise dedup patterns
- No security bugs found — all regex warnings are false positives (anchored patterns)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

src/main.ts

@@ -1095,8 +1095,7 @@ function withInFlightDedup<T>(
         return existing;
     }
 
-    let requestPromise: Promise<T>;
-    requestPromise = factory().finally(() => {
+    const requestPromise: Promise<T> = factory().finally(() => {
         if (store.get(key) === requestPromise) {
             store.delete(key);
         }
@@ -1412,8 +1411,7 @@ function requestTwitchLogin(): Promise<boolean> {
         return twitchLoginInFlight;
     }
 
-    let loginPromise: Promise<boolean>;
-    loginPromise = twitchLogin().finally(() => {
+    const loginPromise: Promise<boolean> = twitchLogin().finally(() => {
         if (twitchLoginInFlight === loginPromise) {
             twitchLoginInFlight = null;
         }
@@ -1883,9 +1881,7 @@ async function cutVideo(
     let inputBytes = 0;
     try {
         inputBytes = fs.statSync(inputFile).size;
-    } catch {
-        inputBytes = 0;
-    }
+    } catch { }
 
     const cutRequiredBytes = Math.max(96 * 1024 * 1024, Math.ceil(inputBytes * 0.75));
     const cutDiskCheck = ensureDiskSpace(path.dirname(outputFile), cutRequiredBytes, 'Video-Cut');