ci: add CI workflow for lint, typecheck and tests

[phmatray]

Summary

• Add .github/workflows/ci.yml with lint (Biome), typecheck (tsc), frontend tests (Vitest), Rust clippy, and Rust tests
• Runs on push/PR to main with concurrency group to cancel stale runs
• Installs Linux dependencies for Tauri builds, caches Rust artifacts

Conventions

Part of org-wide CI/CD standardization effort.

In general, the fix is to add an explicit permissions: block that restricts the GITHUB_TOKEN to the minimal scopes required. Because this workflow only checks out code and runs local tools (lint, tests, TypeScript, Rust tooling) and does not appear to modify repository contents, create releases, or otherwise need write access, contents: read is a safe minimal baseline. You can define this at the workflow root so it applies to all jobs, or at the job level; here, putting it at the root keeps the file concise and still allows per‑job overrides later if needed.

Concretely, edit .github/workflows/ci.yml and insert a permissions: block right after the name: CI line (line 1). The block should be:

permissions:
  contents: read

This will ensure the GITHUB_TOKEN is limited to read‑only repository contents for all jobs that do not override permissions. No additional imports, methods, or other definitions are required, as this is pure workflow configuration.