CI: ruff, mypy, pytest, tsc, eslint with recorded fixtures #30

Why

CI should catch type errors and accidental network calls, and contributors should be able to run the same checks with one command.

In this repo today

The title lists the tools from the original plan. This repo uses oxlint for the web app, not eslint. .github/workflows/ci.yml already runs ruff check, ruff format --check and pytest (against a Postgres service) for the API, and oxlint, prettier --check and the build (which includes tsc) for the web app. Missing: a Python type check, a guard against tests using the network, and a single local entrypoint.

What to build

• A Python type check (mypy or pyright) in CI. Existing errors can be listed in an overrides block that contributors shrink over time, with strict checking on for new modules.
• A pytest guard that fails any test making a real network request. Tests needing upstream data use recorded fixtures in apps/api/tests/fixtures/.
• A root pnpm check script that runs the API and web checks from CONTRIBUTING.md.

Acceptance criteria

• CI is green on main.
• CI fails on a pull request that introduces a type error, and on a test that makes a real request.

See CONTRIBUTING.md for conventions.