fix: conform moved code to eslint indent/quotes, 4-arg mutation callbacks

- eslint --fix on branch-changed backend files (indent shift from the
  module-wrapper nesting in decomposed files); backend lint now 904
  errors vs 1,315 on main
- useMutationWithToast forwards all four TanStack v5 callback args
  (tsc -b strict build flagged the 3-arg passthrough)

backend/src/middleware/secureImageMiddleware.js

@@ -265,7 +265,7 @@ class SecureImageMiddleware {
       'X-Frame-Options': 'DENY',
       'X-XSS-Protection': '1; mode=block',
       'Referrer-Policy': 'strict-origin-when-cross-origin',
-      'Content-Security-Policy': "default-src 'none'; img-src 'self'",
+      'Content-Security-Policy': 'default-src \'none\'; img-src \'self\'',
       
       // Custom security headers
       'X-Protected-Content': 'true',

backend/src/middleware/secureStatic.js

@@ -44,7 +44,7 @@ function secureStatic(basePath, options = {}) {
           // `default-src 'none'` already implies script-src 'none';
           // style-src + img-src(data:) keep normal SVG rendering working.
           if (/\.svg$/i.test(filePath)) {
-            resp.setHeader('Content-Security-Policy', "default-src 'none'; style-src 'unsafe-inline'; img-src 'self' data:");
+            resp.setHeader('Content-Security-Policy', 'default-src \'none\'; style-src \'unsafe-inline\'; img-src \'self\' data:');
             resp.setHeader('X-Content-Type-Options', 'nosniff');
           }
         }

backend/src/routes/adminGuests.js

@@ -74,10 +74,10 @@ router.get(
           'gallery_guests.created_at',
           'gallery_guests.last_seen_at',
           'gallery_guests.email_verified_at',
-          db.raw("COUNT(CASE WHEN photo_feedback.feedback_type = 'like' THEN 1 END) AS likes"),
+          db.raw('COUNT(CASE WHEN photo_feedback.feedback_type = \'like\' THEN 1 END) AS likes'),
-          db.raw("COUNT(CASE WHEN photo_feedback.feedback_type = 'favorite' THEN 1 END) AS favorites"),
+          db.raw('COUNT(CASE WHEN photo_feedback.feedback_type = \'favorite\' THEN 1 END) AS favorites'),
-          db.raw("COUNT(CASE WHEN photo_feedback.feedback_type = 'comment' THEN 1 END) AS comments"),
+          db.raw('COUNT(CASE WHEN photo_feedback.feedback_type = \'comment\' THEN 1 END) AS comments'),
-          db.raw("COUNT(CASE WHEN photo_feedback.feedback_type = 'rating' THEN 1 END) AS ratings"),
+          db.raw('COUNT(CASE WHEN photo_feedback.feedback_type = \'rating\' THEN 1 END) AS ratings'),
           db.raw('COUNT(DISTINCT photo_feedback.photo_id) AS distinct_photos')
         )
         .orderBy('gallery_guests.created_at', 'desc');
@@ -117,7 +117,7 @@ router.get(
       const photos = await db('photos')
         .leftJoin('photo_feedback', function () {
           this.on('photo_feedback.photo_id', '=', 'photos.id')
-            .andOn(db.raw("photo_feedback.feedback_type IN ('like','favorite')"))
+            .andOn(db.raw('photo_feedback.feedback_type IN (\'like\',\'favorite\')'))
             .andOnNotNull('photo_feedback.guest_id');
         })
         .where('photos.event_id', eventId)

backend/src/routes/adminPhotos.js

@@ -1251,7 +1251,7 @@ router.post('/:eventId/chunked-upload/init', adminAuth, requirePermission('photo
     // Validate file size (max 10GB)
     const maxSize = 10 * 1024 * 1024 * 1024;
     if (fileSize > maxSize) {
-      return res.status(400).json({ error: `File too large. Maximum size is 10GB.` });
+      return res.status(400).json({ error: 'File too large. Maximum size is 10GB.' });
     }
 
     const result = await chunkedUpload.initializeUpload({

backend/src/services/restoreService.js

@@ -308,7 +308,7 @@ class RestoreService {
         this.log('info', 'Post-restore migrations applied');
       } catch (migErr) {
         this.log('warn',
-          `Post-restore migrate:safe failed — restore data is in place but the schema may lag the running image. ` +
+          'Post-restore migrate:safe failed — restore data is in place but the schema may lag the running image. ' +
           `A container restart will retry via wait-for-db.sh. Error: ${migErr.message}`);
       }
 
@@ -888,9 +888,9 @@ class RestoreService {
       throw new Error(
         `Database backup file not found. Tried: ${candidates.join(', ')}. ` +
         `Manifest recorded path: ${dbBackupFile}. ` +
-        `Hint: this usually means the manifest's database.backup_file path no longer ` +
+        'Hint: this usually means the manifest\'s database.backup_file path no longer ' +
-        `exists on disk (deleted? moved? volume not mounted?). Check ` +
+        'exists on disk (deleted? moved? volume not mounted?). Check ' +
-        `~/<your-compose-dir>/backup/database/ on the host.`
+        '~/<your-compose-dir>/backup/database/ on the host.'
       );
     }
 
@@ -1043,8 +1043,8 @@ class RestoreService {
         await spawnAsync('psql', [
           '-h', host, '-p', String(port), '-U', user, '-d', maintenanceDb,
           '-c',
-          `SELECT pg_terminate_backend(pid) FROM pg_stat_activity ` +
+          'SELECT pg_terminate_backend(pid) FROM pg_stat_activity ' +
-          `WHERE datname = '${database.replace(/'/g, "''")}' AND pid <> pg_backend_pid()`,
+          `WHERE datname = '${database.replace(/'/g, '\'\'')}' AND pid <> pg_backend_pid()`,
         ], { env });
 
         // Drop and recreate database (extremely dangerous!)

backend/src/services/storage/s3Storage.js

@@ -638,7 +638,7 @@ class S3StorageAdapter extends stream.EventEmitter {
           UploadId: uploadId
         }));
       } catch (abortError) {
-        logger.error(`Failed to abort multipart upload:`, abortError);
+        logger.error('Failed to abort multipart upload:', abortError);
       }
       
       throw error;

frontend/src/hooks/useMutationWithToast.ts

@@ -47,7 +47,7 @@ export function useMutationWithToast<
 
   return useMutation<TData, TError, TVariables, TContext>({
     ...mutationOptions,
-    onSuccess: (data, variables, context) => {
+    onSuccess: (data, variables, onMutateResult, context) => {
       invalidateKeys?.forEach((queryKey) => {
         queryClient.invalidateQueries({ queryKey });
       });
@@ -56,9 +56,9 @@ export function useMutationWithToast<
           typeof successMessage === 'function' ? successMessage(data, variables) : successMessage
         );
       }
-      onSuccess?.(data, variables, context);
+      onSuccess?.(data, variables, onMutateResult, context);
     },
-    onError: (error, variables, context) => {
+    onError: (error, variables, onMutateResult, context) => {
       const message =
         typeof errorMessage === 'function'
           ? errorMessage(error)
@@ -67,7 +67,7 @@ export function useMutationWithToast<
             (error instanceof Error ? error.message : undefined) ||
             'An unexpected error occurred';
       toast.error(message);
-      onError?.(error, variables, context);
+      onError?.(error, variables, onMutateResult, context);
     },
   });
 }