Add full CI pipeline (Lint → Test → Security)

- ci.yml: 3-stage GitHub Actions following code-standards/ci pattern
  - Lint (3min): biome ci
  - Test (10min): npm test with c8 coverage + webpack build + artifacts
  - Security (5min): npm audit (high) + biome lint
- Replace auto-build.yml (single-job install+test+build)
- Add c8 devDep + test:coverage script (text/lcov/html)
- .c8rc.json: include src/ and pro/src/, exclude tests/langs
- Track package-lock.json (required by npm ci in CI)
- Clean up .gitignore: remove .* allowlist antipattern, list specific ignores

.gitignore

@@ -1,10 +1,9 @@
 # Intellij
 *.iml
-.idea
+.idea/
 
 # npm
-node_modules
-package-lock.json
+node_modules/
 pnpm-lock.yaml
 
 # build
@@ -17,5 +16,13 @@ data.json
 # debug
 logs.txt
 
-# hidden files
-.*
+# coverage
+coverage/
+
+# env / secrets
+.env
+.env.local
+
+# OS
+.DS_Store
+Thumbs.db