Replace blanket no-unsafe-* ESLint disables with targeted suppressions

[marcstraube]

Context

The eslint.config.js blanket-disables @typescript-eslint/no-unsafe-* rules for all of src/. Additionally, 6+ inline suppressions exist in source files. This weakens static analysis coverage for non-DOM code.

Goal

Replace blanket disables with per-line suppressions only where DOM API interop requires it. Reduce inline suppressions where structural changes can eliminate them.

Implementation

1. Remove blanket no-unsafe-* disable from eslint.config.js
2. Run ESLint, categorize violations (DOM interop vs fixable)
3. Fix fixable violations, add per-line suppressions with justification for DOM interop
4. Review and reduce remaining inline suppressions across source files

Files

• eslint.config.js
• Multiple src/**/*.ts files

Source: AUDIT2 (-3 Security), AUDIT3 (noted), AUDIT4 (-1 Clean Code)