refactor(frontend): honest effect deps in the app shell and the ui layer (E27 S2)

Burns the first 14 of the 113 hook suppressions. Three verdicts, applied per site:

A useEffect that should not exist (6):
- Avatar remembered "the image failed" as a boolean an effect reset on src change. The
  component is recycled across items in the virtualized feed, so after one avatar 429s the
  next item's slot committed the fallback initial over a perfectly good image and only the
  post-paint effect cleared it. The failure is now keyed BY URL; derived state cannot be stale.
- Combobox cleared the typed query from an effect on `open`. Moved into setOpenAnd, the single
  funnel every close goes through. That also stops a spurious onQueryChange("") AT MOUNT, which
  told a controlled caller its own initial query had been cleared before the user touched it.
- CommandPalette reset query + picked row from an effect. Closed now means UNMOUNTED, not
  hidden, so a fresh open starts blank because mounting already means that -- and the ranking
  memo over every channel, playlist and saved view stops running while the palette is shut.
- Pager's page box held a copy of the page that an effect re-synced; it now derives it and
  keeps a draft only while being edited.
- App's ?link= / ?oauth= / ?admin= one-shots asserted "once per mount" with an empty dep list.
  The ref guard the codebase already uses in 22 places ENFORCES it, so the honest deps can
  include `t` -- which a language switch legitimately changes, and which would otherwise have
  re-fired the toast.

Honest deps that also fix something (5):
- App's module preload was keyed on the account id, so a permission change that alters the
  module set without moving the id never re-preloaded. `preload()` is idempotent, so depending
  on `me` costs nothing.
- App's access-request nudge now re-issues on a language switch; it used to stay in the old
  language until the pending count changed.
- App's diagnostics effect: applyDiagnostics already no-ops on an unchanged effective level,
  so picking four fields out by hand was guarding nothing and missed any field added later.
- DataTable's two filter effects: a ref holds the latest onFiltersChange so commitFilters can
  be stable, which is what lets the effects name it instead of switching the check off.

Genuine escape hatches (7) moved OUT of eslint-suppressions.json into inline directives that
name the invariant at the site -- the toast handover's render-phase global, the live region's
deliberate arming tick, the docked one-slot component, the popover engine's floating-ui list
state, dnd-kit's per-drag `moved` flag, BackToTop's DOM read and the palette's debounced
announcement. A reader of the code now sees why; a JSON file no one opens does not.

Tests: Avatar (3, new file) and Pager (3) pin the derived-state frames with a layout-phase
probe -- layout effects run before any passive effect, so they read the frame the browser would
paint. Combobox (2) pins the close-clears-query contract and the no-callback-at-mount rule.
All three sets mutation-checked against the effect-based originals.

Suppressions 113 -> 99; exhaustive-deps 45 -> 35.

frontend/src/components/ui/CommandPalette.tsx

@@ -81,6 +81,15 @@ export default function CommandPalette({
   onClose: () => void;
   groups: CommandGroup[];
 }) {
+  // Closed means UNMOUNTED, not merely hidden, and that one line replaces the effect that used to
+  // blank the query and the picked row on every open: fresh state is what mounting already means.
+  // It also stops the ranking memo below — which folds and scores every channel, playlist and saved
+  // view — from re-running on every parent render while the palette is shut.
+  if (!open) return null;
+  return <CommandPaletteBody onClose={onClose} groups={groups} />;
+}
+
+function CommandPaletteBody({ onClose, groups }: { onClose: () => void; groups: CommandGroup[] }) {
   const { t } = useTranslation();
   const listId = useId();
   const groupId = useId();
@@ -94,15 +103,6 @@ export default function CommandPalette({
   const activeRef = useRef<HTMLButtonElement | null>(null);
   const listRef = useRef<HTMLDivElement | null>(null);
 
-  // A fresh open starts from a blank field: the palette is for "take me somewhere", and a leftover
-  // query from last time hides everything you might want now.
-  useEffect(() => {
-    if (open) {
-      setQuery("");
-      setPicked(null);
-    }
-  }, [open]);
-
   // The GROUP order stays fixed — modules, channels, playlists, views, actions read the same every
   // time — and the rows are ranked inside each group. The best row overall starts highlighted, so
   // Enter takes the best match even when it sits in a later group.
@@ -144,6 +144,7 @@ export default function CommandPalette({
   const [announced, setAnnounced] = useState("");
   useEffect(() => {
     if (!summary) {
+      // eslint-disable-next-line react-hooks/set-state-in-effect -- the announcement is DEBOUNCED on purpose (ANNOUNCE_DELAY_MS above): a polite region rewritten per keystroke queues one utterance per letter. A timer's result cannot be derived in render, and the empty branch is the same timer's cancel.
       setAnnounced("");
       return;
     }
@@ -151,8 +152,6 @@ export default function CommandPalette({
     return () => window.clearTimeout(timer);
   }, [summary]);
 
-  if (!open) return null;
-
   // Close, wait for this dialog's own Back-to-close entry to be reclaimed, THEN run: most commands
   // navigate, and a pushState issued before that reclaim is undone by it. Only THIS dialog closes —
   // a command that navigates closes whatever is underneath itself, one that does not (a theme) must