chore(01-02): add ESLint flat config + boundaries plugin + CORE-10 firewall rule

- New eslint.config.js (flat, ESLint 9) declaring 9 element types:
  the seven Phase-1 firewall directories (sim, render, ui, save,
  content, audio, store) plus the template's app + game.
- One rule, severity error: sim cannot import from render or ui (CORE-10).
- Default posture allow — Phase 1 enforces ONE rule, not closed-by-default.
- src/sim/__test_violation__/ excluded from default lint glob; the rule's
  end-to-end correctness is proven by Task 2's Vitest test, not by 'lint
  exits 0 on clean code'.
- Added typescript-eslint as devDep (parser only — no rule sets) so
  ESLint can parse .ts/.tsx (Espree default cannot). Documented as a
  Plan 02 deviation in 01-02-SUMMARY.md (Rule 3 — Blocking).

Verifies green on the clean codebase: 0 errors, 0 warnings via
'npm run lint'. Stderr notices from boundaries plugin about deprecated
rule name (element-types vs dependencies in v6) and legacy selector
syntax are informational only — they don't count as ESLint warnings.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

package.json

@@ -40,6 +40,7 @@
     "happy-dom": "^20.9.0",
     "inklecate": "^1.8.1",
     "typescript": "^6.0.3",
+    "typescript-eslint": "^8.59.2",
     "vite": "^8.0.11",
     "vitest": "^4.1.5"
   }