Bump eslint to v10 to resolve brace-expansion/minimatch DoS chain (GHSA-mh99-v99m-4gvg)

[JSONbored]

Context

Split out of #8588 (task 2 of 4) — the remaining npm audit findings after #8588's postcss+tar fix are all one
transitive chain: brace-expansion (high, DoS via unbounded expansion length, GHSA-mh99-v99m-4gvg)
pulled in via minimatch -> @eslint/config-array/@eslint/eslintrc -> eslint. npm audit fix --force resolves it
but bumps eslint 10.8.0 — a semver-major jump — so it needs real verification, not a blind force-fix.

Why this is its own issue

ESLint has a history of breaking flat-config changes across majors. A blind --force risks silently breaking
lint enforcement (either failing loudly in CI, or worse, silently linting less than before) across both the
root workspace and apps/loopover-ui.

Task

• npm audit fix --force (or a manual eslint bump + matching @typescript-eslint/*/plugin bumps) to eslint@10.8.0.
• Review the eslint v9->v10 changelog for flat-config breaking changes relevant to this repo's eslint.config.*.
• Run the full lint suite (root + ui:lint) and confirm it still catches what it caught before (spot-check a
  few known lint rules still fire, not just that the command exits 0 — a broken config can silently no-op).
• Re-run npm audit --audit-level=moderate to confirm the brace-expansion/minimatch/eslint chain is gone.
• npm run test:ci green.

Not urgent/blocking.

[linear-code]

JSO-5966