build: switch to oxfmt and oxlint

[TheGreatAxios]

Closes CL-9377

Summary

• Stacked on build: run prepack with bun #62, the tip of the open stack, so the reformat covers every file on it
• Add oxfmt and oxlint as exact-pinned devDependencies (the repo had no formatter or linter)
• Run lint and format:check in CI after install
• Remove unused imports and a dead grant() test helper (no-unused-vars): sql in src/services/timeline.ts, authorize in src/memory.ts, RerankClientConfig in src/services/search.ts, mock in src/core/degrade-metrics.test.ts, createInMemoryGrantStore/GrantRule/grant() in src/routes/deps.test.ts
• Replace new Array(n).fill(x) with Array.from({ length: n }, () => x) in src/core/degrade-metrics.ts and three test files (unicorn/no-new-array)
• Two inline oxlint-disable-next-line unicorn/no-thenable comments in src/services/transform.test.ts and src/services/search.test.ts: those fakes stand in for drizzle's query builder, which is thenable on purpose
• .oxfmtrc.json sets printWidth: 80 (Prettier's width); everything else is oxfmt's defaults, including sorting package.json keys
• .oxlintrc.json turns the correctness category from warn to error; no rules are disabled
• lint runs oxlint, format runs oxfmt, format:check runs oxfmt --check

Commits

1. build: switch to oxfmt and oxlint: tooling, configs and lint fixes
2. style: format with oxfmt: mechanical reformat only (75 files changed, 1935 insertions(+), 1283 deletions(-)), safe to skip in review