Restore reproducible installs and add CI regression coverage #3

Problem

A fresh checkout is not reproducible: npm ci fails because package-lock.json is out of sync with package.json (missing Hardhat Ignition and transitive packages). There is also no CI workflow, and the core frontend logic (questionEngine, tutor/store, timers, routing, persistence) has no automated tests, so regressions can merge unnoticed.

Current reproduction

npm ci
npm error `npm ci` can only install packages when package.json and package-lock.json are in sync
npm error Missing: @nomicfoundation/hardhat-ignition@0.15.16 from lock file
...

Proposed scope

• Regenerate and commit the lockfile with the supported Node/npm versions; document and pin those versions.
• Add GitHub Actions for clean install, lint, type-check/build, contract compile/tests, and frontend unit/component tests.
• Add deterministic tests for question invariants, adaptive thresholds, Zustand actions/migration, timer races, and route validation.
• Add Solidity coverage/security checks and cache dependencies safely.
• Keep deployment secrets out of pull-request workflows.

Acceptance criteria

• npm ci succeeds from a clean checkout on the documented runtime.
• CI runs on pull requests and protected-branch pushes and blocks merges on failures.
• npm run lint, npm run build, and npm run test:contracts pass in CI.
• Core frontend modules have meaningful regression tests; contract coverage includes reward and leaderboard edge cases.
• README contains one verified local-validation command sequence matching CI.