chore(lint): remove dead eslint-disable directives

The project lints with Biome only, so none of these 78 directives across 57
files ever suppressed anything. Directives that carried the rationale for a
flagged dynamic index access keep that rationale as a plain comment.

src/app/api/badges/leaderboard/route.ts

@@ -356,7 +356,7 @@ export async function GET(req: Request) {
 					]);
 
 				const rarity = Object.fromEntries(
-					// eslint-disable-next-line security/detect-object-injection -- rk from rarityKeys const, i is array index
+					// rk from rarityKeys const, i is array index
 					rarityKeys.map((rk, i) => [rk, rarityBoards[i]]),
 				) as Record<BadgeRarityKey, BoardCore>;
 
@@ -398,7 +398,7 @@ export async function GET(req: Request) {
 			totalBadgesViewer = tb;
 			achievementViewer = ach;
 			rarityViewer = Object.fromEntries(
-				// eslint-disable-next-line security/detect-object-injection -- rk from rarityKeys const, i is array index
+				// rk from rarityKeys const, i is array index
 				rarityKeys.map((rk, i) => [rk, rvs[i]]),
 			) as Record<BadgeRarityKey, Partial<BadgeLeaderboardEntry> | undefined>;
 		}
@@ -414,7 +414,7 @@ export async function GET(req: Request) {
 					viewerEntry: achievementViewer,
 				},
 				rarity: Object.fromEntries(
-					// eslint-disable-next-line security/detect-object-injection -- rk from rarityKeys const
+					// rk from rarityKeys const
 					rarityKeys.map((rk) => [
 						rk,
 						{ ...global.rarity[rk], viewerEntry: rarityViewer[rk] },

src/app/api/leaderboard/route.ts

@@ -110,7 +110,7 @@ export async function GET(req: Request) {
 			async () =>
 				type === "credits"
 					? await loadCreditsRows()
-					: // eslint-disable-next-line security/detect-object-injection -- type validated to "diamonds"|"duckets"
+					: // type validated to "diamonds"|"duckets"
 						await loadCurrencyRows(CURRENCY_TYPE[type]),
 			// Rankings are re-sorted on every read; serving the previous order for a
 			// minute keeps a busy leaderboard off the database.

src/app/api/media/[...path]/route.ts

@@ -51,7 +51,6 @@ export async function GET(
 				headers: SECURITY_HEADERS,
 			});
 		}
-		// eslint-disable-next-line security/detect-non-literal-fs-filename
 		if (!existsSync(filePath)) {
 			return new NextResponse("Not found", {
 				status: 404,
@@ -59,7 +58,6 @@ export async function GET(
 			});
 		}
 
-		// eslint-disable-next-line security/detect-non-literal-fs-filename
 		const bytes = await readFile(filePath);
 		const mime: Record<string, string> = {
 			".png": "image/png",
@@ -76,7 +74,7 @@ export async function GET(
 			headers: {
 				...SECURITY_HEADERS,
 				...(ext === ".svg" ? { "Content-Disposition": "attachment" } : {}),
-				// eslint-disable-next-line security/detect-object-injection -- ext validated against ALLOWED_EXT
+				// ext validated against ALLOWED_EXT
 				"Content-Type": mime[ext] ?? "application/octet-stream",
 				"Cache-Control": "public, max-age=3600, must-revalidate",
 			},

src/app/api/media/route.ts

@@ -12,11 +12,9 @@ import { PERMS } from "@/lib/permissions";
  */
 export const GET = withAdmin({ permission: PERMS.PAGES_EDIT }, async () => {
 	const dir = MEDIA_ROOT;
-	// eslint-disable-next-line security/detect-non-literal-fs-filename
 	if (!existsSync(dir)) {
 		return apiOk({ files: [] });
 	}
-	// eslint-disable-next-line security/detect-non-literal-fs-filename
 	const files = readdirSync(dir)
 		.filter((f) => /\.(png|jpg|jpeg|gif|webp|svg|bmp)$/i.test(f))
 		.map((f) => {

src/app/api/radio/listeners/route.ts

@@ -35,7 +35,7 @@ function findCount(value: unknown, depth = 0): number | null {
 		"count",
 	];
 	for (const key of keys) {
-		// eslint-disable-next-line security/detect-object-injection -- keys from hardcoded array
+		// keys from hardcoded array
 		const v = value[key];
 		if (typeof v === "number" && Number.isFinite(v)) return v;
 		if (