Add Gitea Actions CI + switch to PR-based workflow

- Add .gitea/workflows/ci.yml: typecheck -> lint -> unit -> build -> deterministic
  Playwright e2e against the dev webServer (LLM_STUB=1). No dind/docker/static IP.
- package-lock.json is committed (reproducible `npm ci`); verified npm install is a no-op.
- Add CHANGELOG.md, set version 0.1.0, add .env (gitignored) + .env.example placeholder.
- Document the mandatory feature-branch -> PR -> CI -> auto-merge workflow in
  AGENTS.md + README.md (e2e now runs in CI on every PR).
- Add Playwright html/json reporters (playwright-report/, test-results/e2e.json)
  for the CI E2E-results summary step and the failure artifact upload.

AGENTS.md

@@ -11,6 +11,15 @@ which returns a structured `TurnResult` (events + stat/relation/territory deltas
 validates, clamps, and applies to the world state. A MapLibre choropleth renders territorial
 ownership; the whole thing persists to SQLite and streams over SSE on a single port.
 
+## Change process (mandatory)
+
+1. **Small, incremental, well-tested changes** — work is done one change at a time, in smaller parts; each part is tested before moving on. Connected tasks that touch the same area of code MAY be done together on one branch/PR with a single version bump (e.g. two tweaks to the same panel).
+2. **Feature branch + PR** — every change lands on a feature branch off `master` (no direct pushes to `master`). Open a pull request against `master` on Gitea (`https://git.kkhost.pl`, repo `OpenCode/History`).
+3. **Changelog entry** — every change is listed in `CHANGELOG.md` with a version, date and time (format: `## v<version> — YYYY-MM-DD HH:MM`, then bullet points of what changed).
+4. **Version bump** — the version is updated in `package.json`.
+5. **CI must pass** — branch protection on `master` requires the CI status check to be green before merge. Merge via auto-merge (`POST /repos/OpenCode/History/pulls/{n}/merge` with body `{"do":"merge","merge_style":"merge","merge_when_checks_succeed":true}`) so the PR merges by itself once CI is green. **CI never deploys to production.**
+6. **Tag + manual deploy after merge** — once merged, tag the version on `master` (e.g. `v0.1.0`). Production (`https://history.dev.kkhost.pl`) is updated manually afterwards on the host: `docker compose up -d --build`, then verify the site.
+
 ## Stack
 
 - TypeScript everywhere, `strict: true`
@@ -80,9 +89,11 @@ history/
 | `npm test` | vitest unit tests in `server/` (19 tests) |
 | `npm run typecheck` | `tsc --noEmit` (strict) across src/server/shared/e2e/configs |
 | `npm run lint` | ESLint flat config |
-| `npm run e2e` | Playwright, fully deterministic (`LLM_STUB=1`); overrides dev ports via `VITE_PORT`/`HISTORY_API_PORT` if set |
+| `npm run e2e` | Playwright, fully deterministic (`LLM_STUB=1`); **runs in CI on every PR** (see below) |
 | `docker compose up -d --build` | prod image on :4321, routed via Traefik at `history.dev.kkhost.pl` |
 
+**Local verification (before every PR):** `npm run typecheck` + `npm run lint` + `npm test` (unit) + `npm run build`. The full **e2e** suite (`npm run e2e`) is verified by **CI on every PR** (the Playwright config boots its own dev webServer with `LLM_STUB=1`) — locally you only need the four checks above; e2e is the CI source of truth.
+
 ## Conventions
 
 - **The server is authoritative.** All world state lives in SQLite (`server/db.ts`). The client