Burn down ESLint and Angular lint debt

## Parent

GSA/sam-ui-elements#562

## What to build

Burn down the TypeScript, Angular, and template-accessibility lint debt exposed by the ESLint migration in #566. The migration currently reports 1,632 warnings in the root workspace and 5 in `test-app`. Coordinate independently grabbable cleanup slices, prevent the baseline from regressing, and progressively promote resolved rules from warnings to errors.

This debt cleanup is tracked separately from the Angular 19→21 serial migration so it remains visible without blocking unrelated upgrade steps.

## Acceptance criteria

- [ ] CI prevents the accepted lint baseline from increasing
- [ ] Existing ESLint findings are resolved or covered by an explicit, documented rule decision
- [ ] Resolved rule categories are promoted from warnings to errors
- [ ] Root and `test-app` lint complete with no warnings or errors outside documented exceptions
- [ ] Existing automated tests remain green throughout the cleanup

## Blocked by

- GSA/sam-ui-elements#566