test(gates): the register test parses ruff's TOML and holds pytest.ini line by line

Round 2 of the E32 review found the key whitelists blind: a line regex saw neither a
[lint.per-file-ignores] table nor a quoted key, and pytest.ini's continuation lines and
key: value form slipped past. Ruff's config is now parsed (smol-toml) and held to its
key paths; pytest.ini to its whole lines; the CI ruff steps to --config backend/ruff.toml,
which is what makes that file the whole configuration.

ESLint: every glob of a block must reach a sample (reactPlugin.ts and devOnlyGuard.ts
rode along unseen), a block's own severity is held to src, a no-restricted-* list is held
to the src block's declaration rather than Feed.tsx's effective config, named global
ignores count, an ignored sample is named, and linterOptions are checked. tsconfig.node
must keep allowJs + checkJs while it lists a .js file; knip's positive glob is pinned.

frontend/package-lock.json

@@ -46,6 +46,7 @@
         "knip": "6.27.0",
         "postcss": "^8.4.39",
         "prettier": "3.6.2",
+        "smol-toml": "1.9.0",
         "tailwindcss": "^4.3.3",
         "typescript": "^5.5.3",
         "typescript-eslint": "8.71.0",