Add Gitea Actions CI + switch to PR-based workflow

- Add .gitea/workflows/ci.yml: typecheck -> lint -> unit -> build -> deterministic
  Playwright e2e against the dev webServer (LLM_STUB=1). No dind/docker/static IP.
- package-lock.json is committed (reproducible `npm ci`); verified npm install is a no-op.
- Add CHANGELOG.md, set version 0.1.0, add .env (gitignored) + .env.example placeholder.
- Document the mandatory feature-branch -> PR -> CI -> auto-merge workflow in
  AGENTS.md + README.md (e2e now runs in CI on every PR).
- Add Playwright html/json reporters (playwright-report/, test-results/e2e.json)
  for the CI E2E-results summary step and the failure artifact upload.

README.md

@@ -79,7 +79,14 @@ docker compose up -d --build --force-recreate  # after uncommenting LLM_STUB=1 i
 | `npm test` | vitest unit tests in `server/` (19) |
 | `npm run typecheck` | `tsc --noEmit` (strict) across the whole tree |
 | `npm run lint` | ESLint (flat config) |
-| `npm run e2e` | Playwright, fully deterministic (`LLM_STUB=1`) |
+| `npm run e2e` | Playwright, fully deterministic (`LLM_STUB=1`); runs in CI on every PR |
+
+## Change process
+
+Changes follow a mandatory PR-based workflow (full rules in [AGENTS.md](./AGENTS.md#change-process-mandatory)):
+work on a feature branch off `master` (no direct pushes), add a `CHANGELOG.md` entry and bump the
+`package.json` version, open a PR to `master`, and let **CI pass** (typecheck → lint → unit → build → e2e)
+before auto-merging. After merge, tag the version and deploy manually (`docker compose up -d --build`).
 
 ## Design notes