ci(github): add linting and improve CI workflow

- Add ESLint configuration for backend TypeScript code
- Include linting step in backend quality checks
- Add linting step to GitHub Actions CI workflow
- Enable configurable Prisma query logging via PRISMA_LOG_QUERIES environment variable
- Update PrismaService to support dynamic log levels based on PRISMA_LOG_QUERIES
- Replace BadRequestException with UnauthorizedException in receipt import security tests

backend/src/prisma/prisma.service.ts

@@ -18,8 +18,29 @@ export class PrismaService
     'deleteMany',
   ]);
 
+  private static isTruthy(value?: string): boolean {
+    if (!value) {
+      return false;
+    }
+
+    const normalized = value.trim().toLowerCase();
+    return normalized === '1' || normalized === 'true' || normalized === 'yes' || normalized === 'on';
+  }
+
+  private static resolveLogConfig(): Prisma.LogLevel[] {
+    const includeQueryLogs = PrismaService.isTruthy(process.env.PRISMA_LOG_QUERIES);
+
+    if (includeQueryLogs) {
+      return ['query', 'warn', 'error'];
+    }
+
+    return ['warn', 'error'];
+  }
+
   constructor(private readonly realtimeEvents: RealtimeEventsService) {
-    super();
+    super({
+      log: PrismaService.resolveLogConfig(),
+    });
 
     const realtimeMiddleware: Prisma.Middleware = async (params, next) => {
       const result = await next(params);
@@ -46,6 +67,10 @@ export class PrismaService
 
         await this.$connect();
 
+        if (PrismaService.isTruthy(process.env.PRISMA_LOG_QUERIES)) {
+          this.logger.log('Prisma query logging är aktiverad (PRISMA_LOG_QUERIES=1).');
+        }
+
         this.logger.log('Databasanslutning etablerad.');
         return;
       } catch (error) {
@@ -71,4 +96,4 @@ export class PrismaService
   async onModuleDestroy() {
     await this.$disconnect();
   }
-}
+}

backend/src/receipt-import/receipt-import.security.spec.ts

@@ -1,4 +1,4 @@
-import { BadRequestException } from '@nestjs/common';
+import { BadRequestException, UnauthorizedException } from '@nestjs/common';
 import { ReceiptImportController } from './receipt-import.controller';
 
 describe('ReceiptImport controller security', () => {
@@ -55,11 +55,11 @@ describe('ReceiptImport controller security', () => {
     expect(receiptImportServiceMock.upsertUnitMapping).toHaveBeenCalledWith(99, 1, 'g', 'kg');
   });
 
-  it('upsertUnitMapping nekar när användar-id saknas', async () => {
-    await expect(
-      controller.upsertUnitMapping({ productId: 1, originalUnit: 'g', preferredUnit: 'kg' } as any, { user: {} }),
-    ).rejects.toThrow(BadRequestException);
-  });
+  it('upsertUnitMapping nekar när användar-id saknas', async () => {
+    await expect(
+      controller.upsertUnitMapping({ productId: 1, originalUnit: 'g', preferredUnit: 'kg' } as any, { user: {} }),
+    ).rejects.toThrow(UnauthorizedException);
+  });
 
   it('saveReceipt nekar global alias för icke-admin', async () => {
     const dto = {