chore: add oxlint + oxfmt, upgrade TypeScript to 7, move installs to bun

[jrusso1020]

Problem

Follow-up to Tom's review feedback on #10:

You should really add prettier / oxfmt and eslint / oxlint at some point, and upgrade ts. I'd use bun to install as well. Probably worth a second pr

This is that second PR. (The other two items from that comment — committing the codegen'd file and adding typecheck + vitest to CI — Tom already landed in #10.)

Changes

Linter and formatter: oxlint + oxfmt. Tom offered prettier/oxfmt and eslint/oxlint as either-ors. Picked the oxc pair because that is what hyperframes-oss already runs, so a template for HyperFrames now matches HyperFrames: oxlint . with .oxlintrc.json (correctness: error, react + typescript plugins) and oxfmt . reading .prettierignore.

oxlint reports zero findings on the existing tree, so it lands as a guard rather than a cleanup. I confirmed that is real and not a misconfigured no-op by injecting a throwaway file with a debugger statement and an unkeyed list render — both were caught (no-debugger, react(jsx-key)), then removed.

TypeScript 5.9 → 7.0.2. Typecheck, the 23-test vitest suite, and the full client + SSR build all pass on it.

Installs move to bun. bun.lock replaces package-lock.json; README setup steps updated.

CI split into three jobs so a formatting failure reports separately instead of hiding behind a broken typecheck:

job	runs
lint	oxlint, oxfmt --check
check	typecheck, vitest, composition-manifest freshness
build	vite client + SSR build — not covered by CI before

setup-bun is SHA-pinned to match the existing pinning style. Tests run via bun run test, not bun test, so vitest stays the runner rather than being silently swapped for bun's.

Two deliberate non-changes

package.json and wrangler.jsonc are excluded from the formatter. On its first run oxfmt wanted to reorder package.json's top-level keys (relocating the entire cloudflare block below engines) and to add trailing commas throughout wrangler.jsonc. Both are cosmetic for a spec-compliant parser, but the Deploy to Cloudflare button parses exactly those bytes and is demonstrably strict about them — an empty "preview_image_url": "" broke it in #9 and surfaced as a misleading wrangler parse error (upstream cloudflare/workers-sdk#14831). Reformatting the input to a known-fragile parser for zero benefit is not a trade worth making. Both files are byte-identical to main in this branch, and the reasoning is written into .prettierignore so nobody quietly re-adds them.

The npm run prepare-assets chaining inside dev/build/deploy is left as-is. It works under both bun and npm; switching it to bun run would hard-require bun for anyone still on npm. Install is the thing standardising on bun, not the script bodies.

The Dockerfile still uses npm install for the container's own container/package.json. That is a separate dependency tree baked into the image and unaffected by the root package manager, so it is untouched.

Testing

Full CI gate run locally against the committed tree, all green:

bun install --frozen-lockfile   OK
bun run lint                    OK
bun run format:check            OK
bun run typecheck               OK   (TypeScript 7.0.2)
bun run test                    OK   (3 files, 23 tests)
bun run prepare-assets          OK   (manifest diff clean)
bun run build                   OK   (client + SSR)

The format sweep is isolated in its own commit (style: apply oxfmt across the tree) so the tooling and CI changes stay reviewable.

Not verified end-to-end: that the Deploy button still provisions after the lockfile swap. It cannot be checked without a deploy, and the button caches its verdict per repo path for 30+ minutes. The mitigation is that both files it parses are unchanged here.

— Rames Jusso