chore(repo): improve onboarding and enforce CI quality gates - #17

Summary

Repository professionalism upgrade focused on onboarding reliability and enforceable quality gates.

Plan (project-manager style)

Phase 1 — Onboarding cleanup

• Rewrote README with accurate clone URL and pnpm-based setup
• Added tracked .env.example and linked env requirements
• Added contributor guide with branch, checks, and PR checklist

Phase 2 — Quality gates

• Added typecheck and check scripts to standardize local verification
• Added CI workflow to run install, lint, typecheck, and build on PR/push

Phase 3 — Risk reduction

• Updated .gitignore to allow .env.example while keeping local env files ignored

Risks

• Existing dependency vulnerabilities remain and should be handled in a dedicated security PR.
• Next.js warns about workspace root lockfile selection in monorepo-like environments.

Validation checklist

• pnpm run check
• pnpm run build

Next milestones

1. Add security remediation pass (Dependabot + override review).
2. Migrate deprecated middleware convention to proxy.
3. Add smoke tests for /api/analyze and /api/chat endpoints.