biome-config: add noFloatingPromises and noExcessiveCognitiveComplexity (0.2.0)

[pdrbrnd]

Summary

Adds two rules to `@significa/biome-config` and bumps to `0.2.0`:

• `noFloatingPromises` (nursery, error) — catches unhandled async calls. The most common AI-generated React bug (`useEffect(() => { asyncCall() })` patterns that fail silently).
• `noExcessiveCognitiveComplexity` (complexity, warn, threshold 25) — catches god-functions without being pedantic. Threshold deliberately conservative.

Trial results on ai-studio

Both rules were enabled locally on ai-studio before promotion to verify signal-to-noise:

• noFloatingPromises: 11 real findings across 8 files (generate canvas, history drawer, _authenticated routes, API routes). All legitimate — `useEffect(() => { mutation.mutate() })` and similar.
• noExcessiveCognitiveComplexity: 3 findings (`server/ai/pipeline.ts`, `server/ai/copy-pipeline.ts`, `src/components/generate/history-drawer.tsx`). All legitimate orchestration code worth eventually breaking down.

After merge + publish

ai-studio's `biome.json` currently has both rules added locally as a trial. Once `0.2.0` publishes to npm, ai-studio bumps the dep and removes the local nursery overrides — they'll be inherited from the shared config.

Why bump minor (0.1.0 → 0.2.0)

Adding rules is breaking for consumers (new errors surface). 0.x semver convention: minor bump = potentially breaking changes for consumers.

Test plan

• CI passes on this branch
• After merge: publish 0.2.0 via release workflow
• Bump @significa/biome-config in ai-studio to ^0.2.0, remove local nursery overrides, confirm same findings surface from the shared config

🤖 Generated with Claude Code