Cypress configs are CommonJS under root "type": "module" and will fail to load #2224

Found while verifying #2221. Not a regression from that PR — it's pre-existing and currently latent, since no CI job runs Cypress.

The problem

Root package.json declares "type": "module" (re-added in f42f6fc, the ESM test-suite migration). That makes Node treat every .js under the repo root as ESM — including cypress/plugins/index.js, which is still CommonJS (module.exports = (on, config) => {...}).

cypress/support/index.js is comments-only today, so it's currently harmless, but it's in the same trap the moment anyone adds code to it.

Verified on development with Node v24.14.0:

$ node -e "console.log(typeof require('./cypress/plugins/index.js'))"
object

require() returns an empty namespace object instead of the exported function, so anything that loads the plugins file the way Cypress does will get a non-function — the same failure #2221 fixes for github-actions/pr-instructions/.

Suggested fix

Pick one, all are one-liners:

• rename cypress/plugins/index.js → cypress/plugins/index.cjs (what fix(ci): rename pr-instructions scripts to .cjs so they load under type:module #2221 does), or
• add cypress/package.json containing { "type": "commonjs" } to scope the subtree back to CJS, or
• relocate the file under a directory that already has a CJS package.json.

The cypress/package.json route is the more durable one, since it protects future files added under cypress/ automatically.

Not affected — checked already

• shared/roles.js and shared/authorizationUtils.js also contain module.exports, but they're guarded with if (typeof module !== "undefined" && module.exports) and import each other as ESM, so they load correctly either way.
• backend/ has its own package.json with "type": "module".
• client/ has no type field, so its CJS configs (postcss.config.js, tailwind.config.js, setupProxy.js) are fine.

The only real breakage in the root tree is the Cypress plugins file.