fix: lint: Ban waitForTimeout, setTimeout-as-delay, and fixed sleep patterns (#442)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

web-app/eslint.config.js

@@ -92,6 +92,17 @@ export default [
           message:
             'String interpolation used in a GraphQL query or mutation string. GraphQL queries must not use string interpolation — it bypasses type-checking and is unsafe. Use the `variables` parameter in the fetch body instead. Example: `variables: { holder: address }`. See PR #191 for the pattern.',
         },
+        {
+          selector: "CallExpression[callee.property.name='waitForTimeout']",
+          message:
+            '[BANNED] waitForTimeout is a fixed delay. → Subscribe to events instead (eth_newFilter for on-chain, waitForSelector/waitForURL for DOM). → Polling with timeout is acceptable only if no event source exists. → See AGENTS.md #Engineering Principles.',
+        },
+        {
+          selector:
+            "NewExpression[callee.name='Promise'] > ArrowFunctionExpression CallExpression[callee.name='setTimeout']",
+          message:
+            '[BANNED] Promise+setTimeout sleep pattern. → Use event subscription or polling with timeout instead. → See AGENTS.md #Engineering Principles.',
+        },
       ],
     },
   },