fix: pin eslint to ^9 — dependabot re-landed v10 which crashes eslint-plugin-react

CI revealed eslint had been bumped to ^10 again (react/display-name:
contextOrFilename.getFilename is not a function). Restore ^9 pin so the
declared toolchain matches the vendored components' validated stack.

package.json

@@ -81,7 +81,7 @@
     "@types/react": "^19",
     "@types/react-dom": "^19",
     "@vitest/coverage-v8": "^5.0.1",
-    "eslint": "^10",
+    "eslint": "^9.0.0",
     "eslint-config-next": "16.3.5",
     "eslint-plugin-react": "^7.37.5",
     "husky": "^9.1.7",