fix(ci): make the lint gate fail for real and stop byparr leaking disk

The CI lint step was `biome check . || true`, so it could never fail: 14 real
violations were passing unnoticed. Drop the `|| true` and fix what it found.

Lint fixes, none of which change behaviour:
- give list items their natural identity instead of the array index
  (key={c} / key={char}, key={`skeleton-${i}`})
- document the two useEffect dependency lists that must keep their
  function-declaration handlers, with the reasoning that dropping them broke
  the tree and save-on-Ctrl+S once already (704e3363)
- scope the remaining noArrayIndexKey / useExhaustiveDependencies exemptions to
  the three files that need them, in biome.json instead of scattered comments

Storage, on a host that had grown to 81% disk:
- byparr starts a Firefox per request and never removes the profile it leaves in
  the container's writable layer. With no volume mounted, nothing else reclaimed
  it: 716 profiles / 6.8 GB in two days, ~1.7 GB/day. docker-prune.sh now removes
  orphaned profiles, identifying live ones by the open fd in /proc/<pid>/fd rather
  than by age, because browsers stay warm for ~27 hours here — longer than the
  leak window, so no age threshold can be both safe and useful.
- bound the build cache properly: buildx treats --max-used-space and --filter as
  mutually exclusive, so passing both silently dropped the 4 GB cap and the cache
  reached 49 GB.
- escalate to the emergency prune when / drops below 8 GB free, so the bound holds
  even if the schedule stops.
- clear multi-GB tmp_pack files left behind by a gc that was OOM-killed
  mid-repack; git only removes those on the next successful gc.
- make setup-cron.sh append instead of replacing the crontab (`crontab -`
  overwrites the whole file, which had been dropping the other scheduled jobs),
  and run the prune daily rather than weekly to match the leak rate.

Volumes are still never pruned: mariadb-turbo-data is a database.

src/app/admin/prefixes/prefix-dialog.tsx

@@ -56,6 +56,7 @@ export function PrefixDialog({
 		if (!saving && confirmLeave()) onClose();
 	}
 
+	// biome-ignore lint/correctness/useExhaustiveDependencies: isOpen acts as a trigger here, not a value read in the body; removing it is a real regression, reverted once in 704e3363
 	useEffect(() => {
 		setSaveError(false);
 		if (editPrefix) {

src/app/admin/prefixes/prefixes-client.tsx

@@ -259,7 +259,7 @@ export function PrefixesClient({ canEdit }: { canEdit: boolean }) {
 														{"{"}
 														{[...prefix.text].map((char, i) => (
 															<span
-																key={`char-${i}`}
+																key={char}
 																style={{
 																	color: colors[Math.min(i, colors.length - 1)],
 																}}
@@ -280,9 +280,9 @@ export function PrefixesClient({ canEdit }: { canEdit: boolean }) {
 										</TableCell>
 										<TableCell>
 											<div className="flex items-center gap-1">
-												{colors.slice(0, 5).map((c, i) => (
+												{colors.slice(0, 5).map((c) => (
 													<div
-														key={`color-${i}`}
+														key={c}
 														className="w-4 h-4 rounded border"
 														style={{ backgroundColor: c }}
 														title={c}