chore(lint): enable no-floating-promises in all five ESLint scopes

A floated promise is invisible at review time — the call reads like an
awaited one minus four characters — and the unhandled rejection it
produces surfaces in a different test, in a different file, as a stack
pointing at SDK internals. In #1947 two un-held `callTool` calls made
`npm run ci` unpassable and took a full investigation to attribute; the
fix was two lines. `@typescript-eslint/no-floating-promises` catches the
class outright, so enable it at `error` everywhere.

The rule is type-aware and `tseslint.configs.recommended` is not, so each
scope's config gains a parser project. The four clients name their own
tsconfig projects (both of them — `src` and `__tests__`/`server` live in
different ones). The root scope has no tsconfig at all, so add
`tsconfig.lint.json`: a lint-only project covering `core/**`,
`test-servers/src/**`, and `vitest.shared.mts`, emitting nothing and
gating nothing. It sets `moduleResolution: bundler` deliberately — under
NodeNext `core/`'s extensionless imports fail to resolve, every import
degrades to `any`, and the rule silently stops seeing promises at all.

Measured surface, and the fixes:

- core (2) — `stream.close()` in two Hono `onAbort` listeners. Hono
  invokes subscribers with a bare `subscriber()`, so a promise returned
  from the listener is floated one layer up; `closeAbortedStream` owns
  the rejection where it can actually be owned.
- tui (5) — `handleDisconnect` had no catch of its own and its only
  caller is a key handler that cannot await, so a failing disconnect was
  a live unhandled rejection; it now surfaces the message the way
  `handleConnect` does. The rest are `void` at callers that genuinely
  cannot await, over callees that already own their failures.
- web (92) — 83 are Storybook `expect(...)`, which is instrumented and
  returns a promise, now awaited (`scrollAreaStoryAssertions` is async
  for the same reason). Two tests were asserting against a provider call
  they never awaited. `open(url)` in both web servers now warns instead
  of escaping a synchronous callback.
- cli, launcher — already clean.

Type-aware linting costs time: `clients/web`'s `eslint .` goes from ~8s
to ~19s, inside `validate`. Narrowing the loaded projects is the lever if
that needs reducing later; dropping the rule is not.

Closes #1959

Signed-off-by: cliffhall <cliff@futurescale.com>

clients/web/src/test/core/auth/ema/transportProvider.test.ts

@@ -117,12 +117,12 @@ describe("EmaTransportOAuthProvider", () => {
     expect(await provider.clientInformation()).toEqual({ client_id: "abc" });
     expect(await provider.codeVerifier()).toBe("verifier-xyz");
 
-    provider.saveClientInformation({ client_id: "new" } as never);
+    await provider.saveClientInformation({ client_id: "new" } as never);
     expect(inner.saveClientInformation).toHaveBeenCalledWith({
       client_id: "new",
     });
 
-    provider.saveCodeVerifier("cv");
+    await provider.saveCodeVerifier("cv");
     expect(inner.saveCodeVerifier).toHaveBeenCalledWith("cv");
   });
 

clients/web/src/test/core/mcp/oauthManager.test.ts

@@ -1588,7 +1588,7 @@ describe("OAuthManager", () => {
       });
 
       const provider = await manager.createOAuthProviderForTransport();
-      provider.redirectToAuthorization(
+      await provider.redirectToAuthorization(
         new URL("https://as.example.com/authorize?client_id=abc&state=xyz"),
       );
 
@@ -1610,7 +1610,7 @@ describe("OAuthManager", () => {
       });
 
       const provider = await manager.createOAuthProviderForTransport();
-      provider.redirectToAuthorization(
+      await provider.redirectToAuthorization(
         new URL("https://as.example.com/authorize?client_id=abc&state=xyz"),
       );