Fix herb lint offenses and make lint:check fail on errors

`parallel_lint` in `lint.rake` was mutating a hash inside
`Parallel.map` (which forks processes), so results were invisible
to the parent. The hash stayed empty and `{}.compact.all?` always
returned true, making lint pass even with errors.

Fix by using `Parallel.map` return values directly.

Also resolve all 38 herb lint offenses:
- Add `nonce: true` to `javascript_include_tag` calls
- Split ERB string interpolations into separate `<%= %>` tags
- Replace `link_to "#"` with `<button>` element
- Add `alt` attribute to `image_tag`
- Exclude `public/**/*` from herb linting (static HTML)
- Configure per-file rule exclusions for false positives

Author: thibaudgg

.herb.yml

@@ -31,31 +31,23 @@ linter:
   # # Additional patterns beyond the defaults for linting
   # include:
   #   - '**/*.xml.erb'
-  #
-  # # Patterns to exclude from linting
-  # exclude:
-  #   - 'app/views/admin/**/*'
+
+  # Patterns to exclude from linting
+  exclude:
+    - 'public/**/*'
 
   rules:
     erb-no-extra-newline:
       enabled: true
-  #
-  #   # Rules can have 'include', 'only', and 'exclude' patterns
-  #   some-rule:
-  #     # Additional patterns to check (additive, ignored when 'only' is present)
-  #     include:
-  #       - 'app/components/**/*'
-  #     # Don't apply this rule to files matching these patterns
-  #     exclude:
-  #       - 'app/views/admin/**/*'
-  #
-  #   another-rule:
-  #     # Only apply this rule to files matching these patterns (overrides all 'include')
-  #     only:
-  #       - 'app/views/**/*'
-  #     # Exclude still applies even with 'only'
-  #     exclude:
-  #       - 'app/views/admin/**/*'
+    html-no-unknown-tag:
+      exclude:
+        - 'app/views/members/shop/products/_tag.html.erb'
+    erb-no-unused-expressions:
+      exclude:
+        - 'app/views/members/shop/orders/_order.html.erb'
+    html-require-script-nonce:
+      exclude:
+        - 'app/views/shared/_theme_script.html.erb'
 
 formatter:
   enabled: true

app/views/active_admin/_html_head.html.erb

@@ -8,7 +8,7 @@
 <%= render "shared/theme_script" %>
 
 <%= javascript_importmap_tags "admin" %>
-<%= javascript_include_tag "activestorage" %>
+<%= javascript_include_tag "activestorage", nonce: true %>
 
 <meta name="turbo-refresh-method" content="morph">
 <meta name="turbo-refresh-scroll" content="preserve">

app/views/active_admin/resource/_invoice_preview.html.erb

@@ -4,6 +4,6 @@
   </div>
 
   <% unless invoice.processing? %>
-    <%= image_tag invoice.pdf_file.preview(resize_to_limit: [ 2000, 2000 ]), class: "absolute top-0 z-20" %>
+    <%= image_tag invoice.pdf_file.preview(resize_to_limit: [ 2000, 2000 ]), alt: "", class: "absolute top-0 z-20" %>
   <% end %>
 </div>

app/views/active_storage/blobs/_blob.html.erb

@@ -1,4 +1,4 @@
-<div class="attachment <%= blob.representable? ? "attachment--preview" : "attachment--file" %> <%= "attachment--#{blob.filename.extension}" %>">
+<div class="attachment <%= blob.representable? ? "attachment--preview" : "attachment--file" %>">
   <% limit = local_assigns[:in_gallery] ? [ 800, 600 ] : [ 1024, 768 ]
     # Convert to JPEG and apply quality compression for smaller file sizes.
     # This is appropriate for newsletters/Trix content where transparency isn't needed.

app/views/demo/registrations/new.html.erb

@@ -1,4 +1,4 @@
-<%= javascript_include_tag "hashcash", defer: true, data: { turbo_track: "reload" } %>
+<%= javascript_include_tag "hashcash", defer: true, nonce: true, data: { turbo_track: "reload" } %>
 
 <h1 class="mb-4 text-center text-2xl font-semibold md:text-3xl">
   CSA Admin — <%= set_page_title t("demo.registrations.new.title") %>

app/views/layouts/members/_footer.html.erb

@@ -72,7 +72,7 @@
   <div class="mx-auto mt-12 mb-4 text-gray-300 dark:text-gray-600 <%= "md:mx-0.5" if current_member %>">
     <%= link_to csa_admin_website_url, class: "flex items-center text-sm" do %>
       <%= icon "logo", class: "size-4 me-2 md:ms-0.5 md:me-3 fill-current", variant: "solid" %>
-      <%= "CSA Admin" %>
+      CSA Admin
     <% end %>
   </div>
 </footer>

app/views/members/absences/_absence.html.erb

@@ -5,8 +5,8 @@
   "
 >
   <span class="flex min-w-fit flex-row items-center">
-    <%= "#{l(absence.started_on)} – #{l(absence.ended_on)}" %>
-    <%= " (#{t('.deliveries_count', count: absence.baskets.size)})" %>
+    <%= l(absence.started_on) %> – <%= l(absence.ended_on) %>
+    (<%= t(".deliveries_count", count: absence.baskets.size) %>)
   </span>
 
   <% if absence.note? %>

app/views/members/baskets/_basket.html.erb

@@ -29,7 +29,7 @@
           <%= Absence.model_name.human %>
 
           <% unless basket.absence_id? %>
-            <%= " *" %>
+            *
           <% end %>
         </span>
       <% end %>

app/views/members/bidding_round/pledges/new.html.erb

@@ -16,7 +16,7 @@
       data-hover-id-value="<%= dom_id(membership) %>"
     >
       <div class="text-center text-xl whitespace-nowrap">
-        <%= "#{Membership.model_name.human} #{membership.fiscal_year}" %>
+        <%= Membership.model_name.human %> <%= membership.fiscal_year %>
       </div>
 
       <ul class="mt-4 w-full space-y-1">

app/views/members/billing/_membership.html.erb

@@ -9,7 +9,7 @@
     data-hover-id-value="<%= dom_id(membership) %>"
   >
     <div class="text-center text-xl whitespace-nowrap">
-      <%= "#{Membership.model_name.human} #{membership.fiscal_year}" %>
+      <%= Membership.model_name.human %> <%= membership.fiscal_year %>
     </div>
 
     <ul class="mt-4 w-full space-y-1">