ci: GitHub Actions pipeline (build + static/dynamic tests, cached) + Node 24

[mitekk]

What

Adds a GitHub Actions CI pipeline that runs build + static + dynamic tests on every push/PR, with caching, and consolidates the Node version to a single source of truth (Node 24).

Modeled on the sibling mitekk/pool-stars ci/add-github-actions conventions, adapted to this repo's container-targeted test suite.

Two jobs (mirror the Makefile, not re-implementations)

Job	Runs	Local equivalent
static	npm ci → build (shared → backend → frontend) → lint → typecheck → backend unit tests → advisory npm audit	make lint + make typecheck + make test-be
e2e	builds & boots the dockerized stack, runs the in-container Playwright integration + e2e suite, tears down	make test

e2e is gated behind static (needs: static) so we don't pay Docker build/boot time when cheap checks fail.

Caching (reused resources)

• npm download cache (~/.npm) via setup-node.
• Next.js build cache (frontend/.next/cache) via actions/cache.
• Docker build layers via Compose Bake + Buildx reading x-bake type=gha from a CI-only docker-compose.ci.yml (no runtime changes; never used locally). Playwright browsers are covered by the tests image's base layer.

Node 24 consolidation

• New .nvmrc (24.16.0) is the single source of truth: the static job reads it via node-version-file; nvm use picks it up locally.
• The images keep their digest-pinned NODE_IMAGE (node:24.16.0-alpine3.23@sha256:…) for reproducibility + the make scan CVE gate, cross-referenced to .nvmrc by comment.
• This PR also lands the previously-uncommitted Node-24 upgrade that was sitting in the working tree (digest-pinned bases + prod-deps prune stage, @types/node 24, make scan, lockfile) — required for host/image consistency.

Docs

• docs/ci.md — full pipeline reference (jobs, triggers, Node sourcing, caching, reproduce-locally table).
• docs/adr/0008-github-actions-ci.md — the decision record; indexed in docs/adr/README.md and linked from the README.

Verified locally (Node 24 images)

• ✅ npm ci, build (shared/backend/frontend), lint, typecheck
• ✅ 11 backend unit tests (RTP 0.9507 within [0.90, 0.97])
• ✅ npm audit --audit-level=high (advisory; only moderate advisories)
• ✅ full make test — 17 integration + 1 e2e all green, clean teardown
• ✅ docker compose -f … -f docker-compose.ci.yml config valid

Note: the gha Docker layer-cache backend only activates on the GitHub runner; the commands it wraps are all proven locally above. This PR run is the first exercise of that cache.

🤖 Generated with Claude Code