chore(lint): remove dead eslint-disable directives

The project lints with Biome only, so none of these 78 directives across 57
files ever suppressed anything. Directives that carried the rationale for a
flagged dynamic index access keep that rationale as a plain comment.

src/lib/services/currency.ts

@@ -14,6 +14,6 @@ const LABELS: Record<CurrencyType, string> = {
 };
 
 export function currencyLabel(type: CurrencyType): string {
-	// eslint-disable-next-line security/detect-object-injection -- type is CurrencyType enum
+	// type is CurrencyType enum
 	return LABELS[type];
 }

src/lib/services/email.ts

@@ -55,12 +55,10 @@ async function writeToFile(
 ): Promise<boolean> {
 	try {
 		const logDir = resolve(process.cwd(), "storage", "logs");
-		// eslint-disable-next-line security/detect-non-literal-fs-filename
 		await mkdir(logDir, { recursive: true });
 		const timestamp = new Date().toISOString().replace(/[:.]/g, "-");
 		const filename = `email-${timestamp}.html`;
 		const content = `<!-- To: ${to} | From: ${from} | Subject: ${subject} -->\n${html}`;
-		// eslint-disable-next-line security/detect-non-literal-fs-filename
 		await writeFile(resolve(logDir, filename), content, "utf-8");
 		logger.info("Email written to file", { module: "email", filename });
 		return true;

src/lib/services/ip-lookup.ts

@@ -59,7 +59,7 @@ export async function checkVpn(ip: string): Promise<IpVerdict> {
 			string,
 			{ proxy?: string; type?: string }
 		>;
-		// eslint-disable-next-line security/detect-object-injection -- ip is the API response key from proxycheck
+		// ip is the API response key from proxycheck
 		const entry = d?.[ip];
 		if (entry?.proxy === "yes")
 			return { blocked: true, reason: `${entry.type ?? "Proxy"} detected` };

src/lib/services/send-currency.ts

@@ -84,7 +84,7 @@ export async function sendCurrency(
 			data: { credits: { increment: amount } },
 		});
 	} else {
-		// eslint-disable-next-line security/detect-object-injection -- type is CurrencyName union, not "credits"
+		// type is CurrencyName union, not "credits"
 		const t = TYPE_VALUE[type];
 		await deps.db.usersCurrency.upsert({
 			where: { userId_type: { userId, type: t } },

src/lib/services/site-settings.ts

@@ -128,7 +128,7 @@ class SiteSettings {
 	): Promise<string | null> {
 		const map = await this.load();
 		if (map.has(key)) return map.get(key) as string;
-		// eslint-disable-next-line security/detect-object-injection -- guarded by `key in DEFAULTS`
+		// guarded by `key in DEFAULTS`
 		if (key in DEFAULTS) return DEFAULTS[key] as string;
 		return fallback;
 	}