chore: add ESLint with security plugin, fix code quality warnings

- Install eslint, typescript-eslint, eslint-plugin-security
- Add eslint.config.mjs with project-tuned rules
- Fix redundant catch assignment in cutVideo
- Fix let→const for promise dedup patterns
- No security bugs found — all regex warnings are false positives (anchored patterns)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

eslint.config.mjs

@@ -0,0 +1,25 @@
+import js from '@eslint/js';
+import tseslint from 'typescript-eslint';
+import security from 'eslint-plugin-security';
+
+export default [
+    js.configs.recommended,
+    ...tseslint.configs.recommended,
+    security.configs.recommended,
+    {
+        files: ['src/**/*.ts'],
+        rules: {
+            // Tune down noisy rules for existing codebase
+            '@typescript-eslint/no-explicit-any': 'off',
+            '@typescript-eslint/no-unused-vars': ['warn', { argsIgnorePattern: '^_' }],
+            'no-console': 'off',
+            'security/detect-object-injection': 'off', // Too many false positives with Record types
+            'security/detect-non-literal-fs-filename': 'off', // All paths come from controlled sources
+            'no-async-promise-executor': 'warn',
+            'no-empty': ['warn', { allowEmptyCatch: true }],
+        }
+    },
+    {
+        ignores: ['dist/**', 'release/**', 'node_modules/**', 'scripts/**', 'tmp_*/**']
+    }
+];

package.json

@@ -25,10 +25,14 @@
     "electron-updater": "^6.1.0"
   },
   "devDependencies": {
+    "@eslint/js": "^10.0.1",
     "@types/node": "^20.10.0",
     "electron": "^28.0.0",
     "electron-builder": "^24.9.0",
-    "typescript": "^5.3.0"
+    "eslint": "^10.1.0",
+    "eslint-plugin-security": "^4.0.0",
+    "typescript": "^5.3.0",
+    "typescript-eslint": "^8.57.1"
   },
   "build": {
     "appId": "de.24-music.twitch-vod-manager",

src/main.ts

@@ -1095,8 +1095,7 @@ function withInFlightDedup<T>(
         return existing;
     }
 
-    let requestPromise: Promise<T>;
-    requestPromise = factory().finally(() => {
+    const requestPromise: Promise<T> = factory().finally(() => {
         if (store.get(key) === requestPromise) {
             store.delete(key);
         }
@@ -1412,8 +1411,7 @@ function requestTwitchLogin(): Promise<boolean> {
         return twitchLoginInFlight;
     }
 
-    let loginPromise: Promise<boolean>;
-    loginPromise = twitchLogin().finally(() => {
+    const loginPromise: Promise<boolean> = twitchLogin().finally(() => {
         if (twitchLoginInFlight === loginPromise) {
             twitchLoginInFlight = null;
         }
@@ -1883,9 +1881,7 @@ async function cutVideo(
     let inputBytes = 0;
     try {
         inputBytes = fs.statSync(inputFile).size;
-    } catch {
-        inputBytes = 0;
-    }
+    } catch { }
 
     const cutRequiredBytes = Math.max(96 * 1024 * 1024, Math.ceil(inputBytes * 0.75));
     const cutDiskCheck = ensureDiskSpace(path.dirname(outputFile), cutRequiredBytes, 'Video-Cut');