chore: strengthen lint coverage and update project housekeeping

- Recursively lint all production JS/JSX under src/ and shared/
- Exclude tests, mocks, and node_modules from static guard
- Update TODO status
- Exclude TODO.md from Docker build context

shared/tests/static.eslint.test.js

@@ -1,21 +1,30 @@
 // STATIC GUARD: prod source must pass eslint with zero errors/warnings.
-// Scans App.js + storage adapters + shared modules. Catches unused imports,
+// Scans ALL .js/.jsx in src/ + shared/ (excl tests/mocks). Catches unused imports,
 // dead code, undefined vars before they hit the browser console.
 // Run via: npx eslint <files> --format json -> parse -> fail on any problem.
 const { execSync } = require('child_process');
 const path = require('path');
+const fs = require('fs');
 
 const ROOT = path.resolve(__dirname, '..', '..');
 
+function walkJs(dir) {
+  let out = [];
+  for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
+    const full = path.join(dir, entry.name);
+    if (entry.isDirectory()) {
+      if (entry.name === 'node_modules' || entry.name === 'tests' || entry.name === '__mocks__') continue;
+      out = out.concat(walkJs(full));
+    } else if (/\.(js|jsx)$/.test(entry.name)) {
+      out.push(full);
+    }
+  }
+  return out;
+}
+
 const TARGETS = [
-  'src/App.js',
-  'src/storage/contract.js',
-  'src/storage/firebase.js',
-  'src/storage/index.js',
-  'src/storage/server.js',
-  'shared/index.js',
-  'shared/logEvent.js',
-  'shared/turn.js',
+  ...walkJs(path.join(ROOT, 'src')),
+  ...walkJs(path.join(ROOT, 'shared')),
 ];
 
 function runEslint(files) {