build(frontend): React 18 -> 19 with the React Compiler (E27 S1)

The compiler auto-memoises, which is the point: it infers what the app's
112 `useCallback` and 48 `useMemo` call sites were hand-written for and
applies the equivalent itself. It is on repo-wide with no opt-out list —
it bails on anything it cannot prove safe, and says so through the lint
rules. Verified in the built bundle rather than assumed: 369
`react.memo_cache_sentinel` markers across 35 of the 76 chunks.

ONE transform, shared by vite.config.ts and vitest.config.ts through
reactPlugin.ts. Not two `react()` calls: if the compiler ran only in the
production build, every vitest run would exercise code the user never
receives and a compiler-induced change would ship green — the same
gate-vs-image split 0.93.2 was released to fix. The plugin is imported
rather than named by the usual string, because a string is invisible to
knip and, worse, a typo in it is a silent no-op that ships an uncompiled
bundle, while a bad import is a tsc error.

eslint-plugin-react-hooks 5 -> 7 brings the whole compiler rule set: 283
findings, triaged rather than bulk-suppressed, because the two halves
needed different answers.

  react-hooks/refs (217) is OFF. 153 of those 217 are this app's popover
  architecture, not its history: 79 are @floating-ui/react's documented
  `pop.refs.setReference` / `getReferenceProps` callback-ref setters, and
  74 more are passing the popover handle down as a prop, which is what
  components/ui's popover engine is for. Suppressing them would not help
  the next popover anyone writes. The remaining ~64 are genuine
  render-phase `ref.current = x` writes and are real, but the rule cannot
  tell them apart here; they are E27 S2's work.

  The other 66 go into eslint-suppressions.json as a ratchet — new
  violations fail the gate, and `--prune-suppressions` makes a fixed one
  fail too until it is removed. 45 of them are `set-state-in-effect`,
  which IS E27 S2's subject, so that sprint now has a measured worklist.

react-i18next deliberately stays on 14. It never declared a React-19
peer — every version from 14 to 17 asks only for `react >= 16.8.0` — and
what the newer lines actually require is i18next 25/26 against our 23.
That is an i18n runtime migration wearing a React hat, and it buys this
sprint nothing.

Two React 19 type changes: `useRef<T>(null)` is now `RefObject<T | null>`
(the honest shape — the element is null until it mounts), so
PlexPlayerSettings' prop follows; and reactPlugin.ts joins
tsconfig.node.json's include.

The compiler skips memoising VirtualGrid and reports it: TanStack
Virtual's `useVirtualizer()` returns functions that cannot be memoised
without going stale. That is the right trade for a component whose cost
is its row window, and it is the one such site in the app, so it carries
a targeted disable with the reason — a second incompatible library
anywhere else must still stop the gate.

Nine lanes green, vitest 1558. Browser UAT on the dev server against the
still-running React 18 build as a control: boot, feed (virtualized grid,
popover menu, a filter change that moved the list 195,187 -> 64 items
with the URL mirrored, so no stale memoised UI), command palette, player
modal — no console errors on any of it.

frontend/eslint.config.js

@@ -187,6 +187,25 @@ export default tseslint.config(
     },
     rules: {
       ...reactHooks.configs.recommended.rules,
+      // eslint-plugin-react-hooks 7's `recommended` is no longer two rules — it carries the whole
+      // React Compiler rule set (E27 S1). On this codebase that lands 283 findings, and they were
+      // triaged rather than bulk-suppressed, because the two answers are different:
+      //
+      //   react-hooks/refs  217 — OFF, see below.
+      //   the other 66      — real, and suppressed into eslint-suppressions.json as a RATCHET:
+      //                       new violations fail the gate, the existing list burns down in E27 S2
+      //                       (45 of them are `set-state-in-effect`, which IS that sprint's subject).
+      //
+      // `refs` is off because it fires on this app's popover architecture, not on its history, so
+      // suppressing it would not help the next popover anyone writes. Measured over the 217:
+      // 79 are `pop.refs.setReference` / `getReferenceProps` — @floating-ui/react's callback-ref
+      // setters, which are the documented way to use it — and 74 more are passing the popover handle
+      // down as a prop (`popover={pop}`, `ref={fade.ref}`), which is what `components/ui`'s popover
+      // engine is FOR. That is 153 of 217 flagged for having the word `refs` in an object that is not
+      // a React ref. The remaining ~64 are genuine render-phase `someRef.current = x` writes and are
+      // real; they are E27 S2's work, not this rule's, because the rule cannot tell them apart here.
+      // Re-evaluate when the rule can: it shipped in 1.0.0 and this looks like over-approximation.
+      "react-hooks/refs": "off",
       "local/jsx-comment-text": "error",
       "local/focus-safe-disabled": "error",
       "local/literal-a11y-text": "error",