chore: CI workflow (lint, typecheck, tests, coverage >=75%, architecture)

[constk]

Problem

Local pre-commit can be bypassed; CI is the non-bypassable gate. Without CI from day one, broken changes land on develop and main.

Proposed solution

Port .github/workflows/ci.yml jobs: Lint+Format (ruff check + ruff format --check), Type Check (mypy --strict src/ tests/), Unit tests (pytest -m "not integration"), Integration tests (placeholder until a domain DB layer exists), Coverage (pytest with --cov-fail-under=75), Architecture (lint-imports), Pre-commit (run --all-files), Frontend Build (npm run build), Frontend Quality (eslint --max-warnings 0 + prettier --check + tsc --noEmit + vitest).

Acceptance criteria

• Every job runs on push to any branch and on PRs.
• Coverage gate set to 75% (lower temporarily if coverage tooling reports below for the empty scaffold; document).
• Frontend jobs depend on frontend/ existing (skip cleanly if absent before feat: frontend scaffold (Vite + React 19.2 + TS strict, eslint flat + prettier + vitest) #21).
• Workflow uses pinned action SHAs, not floating tags.

Priority rationale

Critical: this is the gate that defines the template's quality floor.

Depends on

#2, #3