chore(web): upgrade eslint-plugin-react-hooks to 7.1.x + fix flagged smells

[iaj6]

What

Completes the deferred follow-up from #7: it pinned eslint-plugin-react-hooks to 7.0.1 to dodge the new React Compiler lint rules. This bumps the override to 7.1.1, turns those rules on, and fixes the 12 violations they flag.

The rules now active: react-hooks/purity (no clock/impure reads in render), react-hooks/set-state-in-effect (no synchronous setState in effects), react-hooks/refs (no ref writes during render), react-hooks/immutability (no use-before-declare).

The override is kept as an explicit pin rather than removed: this plugin ships new CI-gating lint rules in minor releases, and [email protected] only requests ^7.0.0 — so a deliberate pin protects CI from a surprise float to 7.2.x.

Real fixes (behavior-preserving)

File	Rule	Change
hooks/useEventSource.ts	refs	Write onEvent into the ref from a useEffect, not during render. Only async SSE handlers read it, strictly after commit.
hooks/useSessions.ts	immutability	Hoist the markUpdated useCallback above its first use — declaration-order only; deps/body/call-site byte-for-byte unchanged.
settings/ApiTokensSection.tsx, settings/UsersSection.tsx	set-state-in-effect	Move the mount fetch into a cancellable async IIFE so setState lands after the await. Kept the try/finally so a rejected fetch / throwing res.json() can't strand the loading spinner.
events/EventLog.tsx	purity	Read the clock from an interval-refreshed now state instead of Date.now() during render. Strictly less churny than the prior per-render read (the since param isn't forwarded to the SSE stream, so no reconnect thrash); time-window cutoff lags ≤30s.

Scoped eslint-disables (genuine false positives)

Terminating derived-state resets (setPage(0), setSelectedIndex(0) in AuditSection / CommandPalette) and intentional point-in-time pause snapshots in EventLog. Each has a justifying comment.

Verification

• ✅ web lint 0 errors / 0 warnings
• ✅ npm run build green (all packages incl. Next build)
• ✅ 1166 tests pass
• ✅ clean npm ci (lock ↔ package.json consistent; 45 Linux optional deps preserved for Linux CI)
• ✅ Adversarial 4-lens behavior-preservation review — caught a stranded-spinner regression on the fetch error path (missing try/finally in the inlined mount fetch), now fixed; the other 3 lenses confirmed the diff is behavior-preserving.

🤖 Generated with Claude Code