chore(frontend): update dependencies and adapt to oxlint 1.79

npm install was failing with ERESOLVE: the lockfile pinned storybook 10.5.7
and vitest 4.1.10 as peers while package.json asked for ^10.5.9 and ^4.1.11,
and npm would not move either. Neither npm update, a targeted install, nor
--package-lock-only broke the cycle, so node_modules and package-lock.json
were regenerated from scratch (601 packages, 0 vulnerabilities).

oxlint 1.79.0 then promoted five React Compiler rules into the correctness
category, flagging 101 pre-existing sites. 1.78.0 exits 0 on the same tree,
so nothing in our code changed - the rule set grew. They are fixed rather
than suppressed:

- refs (31): latest-value ref writes moved out of render into an effect.
  onlineClientsRef turned out to be write-only and is gone; expireDiffRef
  and trafficDiffRef were replaced by reading the values directly.
- set-state-in-effect (55): reset-on-open modals now adjust state during
  render; where an effect mixed a synchronous reset with an async fetch, the
  reset moved to render and the effect kept only the request. useMediaQuery
  became useSyncExternalStore.
- preserve-manual-memoization (11): optional-chained deps the compiler cannot
  match, hoisted to locals or dropped where the memo wrapped a string concat.
- purity (3): Date.now() in render replaced by a state-backed clock, which
  also refreshes the expiry tag every 60s instead of freezing it until the
  next unrelated re-render.
- immutability (1): applyClientStatsEvent merged websocket traffic into
  DBInbound rows in place; it now rebuilds only the rows it touches.

Two things fell out of that. clientCount is derived with useMemo instead of
an imperative rebuildClientCount() called from five sites, which also fixes a
staleness bug where changing the expiry or traffic threshold left the counts
alone until some later rebuild. statsVersion existed only to force a
re-render after an in-place mutation, is meaningless now that rows are
replaced, and nothing read it, so it is removed.

Also adds a lint:fix script - oxlint --fix was previously only reachable
through the lint-staged hook.

frontend/src/pages/inbounds/form/protocols/vless.tsx

@@ -1,4 +1,4 @@
-import { useEffect, useState } from 'react';
+import { useState } from 'react';
 import { useTranslation } from 'react-i18next';
 import { Button, Form, Input, InputNumber, Select, Space, Typography } from 'antd';
 import { Controller, useFormContext } from 'react-hook-form';
@@ -29,9 +29,11 @@ export default function VlessFields({
   const { control } = useFormContext();
   const [authKind, setAuthKind] = useState<VlessAuthKind>(vlessAuthKind ?? 'x25519');
 
-  useEffect(() => {
+  const [syncedAuthKind, setSyncedAuthKind] = useState(vlessAuthKind);
+  if (vlessAuthKind !== syncedAuthKind) {
+    setSyncedAuthKind(vlessAuthKind);
     setAuthKind(vlessAuthKind ?? 'x25519');
-  }, [vlessAuthKind]);
+  }
 
   const authOptions = (Object.entries(VLESS_AUTH_LABEL_KEYS) as [VlessAuthKind, string][]).map(
     ([value, labelKey]) => ({ value, label: t(labelKey) }),

frontend/src/pages/inbounds/form/security/RealityTargetScannerModal.tsx

@@ -23,10 +23,11 @@ export default function RealityTargetScannerModal({
   const [query, setQuery] = useState('');
   const [results, setResults] = useState<RealityScanResult[]>([]);
   const scanRef = useRef(scanRealityCandidates);
-  scanRef.current = scanRealityCandidates;
+  useEffect(() => {
+    scanRef.current = scanRealityCandidates;
+  });
 
-  const runScan = useCallback(async (targets?: string) => {
-    setLoading(true);
+  const applyScan = useCallback(async (targets?: string) => {
     try {
       setResults(await scanRef.current(targets));
     } finally {
@@ -34,11 +35,29 @@ export default function RealityTargetScannerModal({
     }
   }, []);
 
+  const runScan = useCallback(
+    (targets?: string) => {
+      setLoading(true);
+      setResults([]);
+      void applyScan(targets);
+    },
+    [applyScan],
+  );
+
+  // Clearing the previous results is done during render so the auto-scan effect
+  // carries only the request itself.
+  const [scannedOpen, setScannedOpen] = useState(false);
+  if (open !== scannedOpen) {
+    setScannedOpen(open);
+    if (open) {
+      setResults([]);
+      setLoading(true);
+    }
+  }
+
   useEffect(() => {
-    if (!open) return;
-    setResults([]);
-    runScan();
-  }, [open, runScan]);
+    if (open) void applyScan();
+  }, [open, applyScan]);
 
   const columns: ColumnsType<RealityScanResult> = [
     {