Exclude the worktrees the tooling was already meant to exclude

git, eslint and vitest each carry an exclusion for local development
worktrees, and all three name /.worktrees/ while the convention actually in
use is /.wt-*/. Every one of them was therefore walking eleven full copies of
the source tree.

The consequences differed by tool and none of them announced itself. pnpm lint
took ten minutes instead of one and reported warnings from whatever commits
those copies happened to sit on. vitest collected duplicate suites that drag in
a second React instance, which fails in ways that have nothing to do with the
working tree. git left them merely untracked, one git add -A away from
committing the repository eleven times over.

With the true warning count finally visible, teach no-unused-vars the
underscore convention this codebase already follows and drop the five
disable directives that convention made redundant. pnpm lint is clean.

A non-underscore unused argument still warns; that was checked rather than
assumed.

src/app/api/feature-flags/route.ts

@@ -40,7 +40,6 @@ import { apiSuccess } from "@/lib/api-response";
 import { getAssistantFlags } from "@/lib/feature-flags";
 import { annotate } from "@/lib/logging/context";
 
-// eslint-disable-next-line @typescript-eslint/no-unused-vars
 export const GET = apiHandler(async (_request: NextRequest) => {
   await requireAuth();
   annotate({ action: { name: "feature-flags.read" } });

src/app/api/measurement-categories/route.ts

@@ -62,7 +62,6 @@ const CATEGORY_ORDER: readonly MeasurementCategory[] = [
   "metabolic",
 ] as const;
 
-// eslint-disable-next-line @typescript-eslint/no-unused-vars
 export const GET = apiHandler(async (_request: NextRequest) => {
   await requireAuth();
 

src/app/api/sync/state/route.ts

@@ -43,7 +43,6 @@ import {
   TOMBSTONE_RETENTION_DAYS,
 } from "@/lib/auth/native-client";
 
-// eslint-disable-next-line @typescript-eslint/no-unused-vars
 export const GET = apiHandler(async (_request: NextRequest) => {
   const { user } = await requireAuth();