ci: establish main quality gates

[PeterGuy326]

Closes #6

What

• run backend tests, dashboard typecheck, production build, and dependency audit in parallel
• gate the full Compose smoke test on all four quality checks
• verify health/readiness response bodies, dashboard output, migration completeness, and migration idempotency
• use minimum token permissions, masked ephemeral database credentials, failure diagnostics, and unconditional cleanup
• document local checks and the five stable branch-protection contexts

Local verification

• actionlint and YAML parsing passed
• all 22 embedded Bash scripts passed syntax checks
• 37 backend tests, dashboard typecheck, and production build passed
• both production dependency audits and Compose config validation passed