ci: typecheck + build on every PR

Adds .github/workflows/ci.yml running lint, typecheck, and build on
pull_request + push to main. Node 20 (matches the engines we'll pin
in the metadata PR), npm cache keyed on package-lock.json,
concurrency cancel so force-pushes don't queue runs.

Also adds a `typecheck` script to package.json — `tsc --noEmit`. Next
runs its own typecheck during `build`, but exposing it as a script
means editors and pre-commit hooks can invoke it cheaply, and CI can
surface type errors separately from build errors.

Build passes with dummy env vars (tested locally with .env.local
moved aside); NEXT_PUBLIC_SUPABASE_URL, NEXT_PUBLIC_SUPABASE_ANON_KEY,
and ENCRYPTION_KEY are set to placeholder values inside the workflow.

Lint is wired up but marked continue-on-error for now: the repo has
14 pre-existing errors from React 19's new react-hooks/set-state-in-
effect rule, across 8 files, that are out of scope for this PR. They
still show up in the CI logs so regressions are visible; a follow-up
PR will fix them and drop the non-blocking flag.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

.github/workflows/ci.yml

@@ -0,0 +1,51 @@
+name: CI
+
+on:
+  pull_request:
+    branches: [main]
+  push:
+    branches: [main]
+
+# Cancel older CI runs for the same branch when a new commit arrives —
+# saves minutes when someone pushes a stack of fixes to one PR.
+concurrency:
+  group: ci-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  check:
+    name: Lint, typecheck, build
+    runs-on: ubuntu-latest
+    # Dummy env vars so `next build` doesn't fail when it reads the
+    # public Supabase config at build time. These never leave CI and
+    # never hit a real service — they just satisfy the `!` non-null
+    # assertions in the client factories.
+    env:
+      NEXT_PUBLIC_SUPABASE_URL: https://ci.example.supabase.co
+      NEXT_PUBLIC_SUPABASE_ANON_KEY: ci-dummy-anon-key
+      ENCRYPTION_KEY: '0000000000000000000000000000000000000000000000000000000000000000'
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 20
+          cache: npm
+
+      - name: Install dependencies
+        run: npm ci
+
+      # Lint is non-blocking for now — the repo has pre-existing
+      # `react-hooks/set-state-in-effect` errors surfaced by the React
+      # 19 rule set. The step still runs so regressions are visible,
+      # but a failure here doesn't block merges until the backlog is
+      # cleared in a follow-up PR.
+      - name: Lint
+        continue-on-error: true
+        run: npm run lint
+
+      - name: Typecheck
+        run: npm run typecheck
+
+      - name: Build
+        run: npm run build

package.json

@@ -6,7 +6,8 @@
     "dev": "next dev",
     "build": "next build",
     "start": "next start",
-    "lint": "eslint"
+    "lint": "eslint",
+    "typecheck": "tsc --noEmit"
   },
   "dependencies": {
     "@base-ui/react": "^1.4.0",