feat: add CI, Docker, auth, typed API client, shiki code blocks, e2e tests

- CI: GitHub Actions (bun 1.3.14, lint/typecheck/test/build/format gates)
- Docker: multi-stage standalone build + .dockerignore (next.config output=standalone)
- Auth: better-auth server (memory adapter, drizzle-swap-ready) + react client
  + /api/auth/[...all] route handler
- API: /api/health + /api/openapi routes, openapi-typescript codegen to
  types/api.ts, typed openapi-fetch client (lib/api, lib/http)
- Shiki: server-side CodeBlock component (escaped HTML)
- E2E: playwright home + health specs on dedicated :3100 (chromium 1243
  installed from GCS after CDN timeout)
- Dev: allow 127.0.0.1/localhost dev origins (HMR for local tooling)

types/api.ts

@@ -0,0 +1,100 @@
+/**
+ * This file was auto-generated by openapi-typescript.
+ * Do not make direct changes to the file.
+ */
+
+export interface paths {
+  "/api/health": {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    get: operations["getHealth"];
+    put?: never;
+    post?: never;
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  "/api/auth/{action}": {
+    parameters: {
+      query?: never;
+      header?: never;
+      path: {
+        action: string;
+      };
+      cookie?: never;
+    };
+    get: operations["authAction"];
+    put?: never;
+    post?: never;
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+}
+export type webhooks = Record<string, never>;
+export interface components {
+  schemas: never;
+  responses: never;
+  parameters: never;
+  requestBodies: never;
+  headers: never;
+  pathItems: never;
+}
+export type $defs = Record<string, never>;
+export interface operations {
+  getHealth: {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    requestBody?: never;
+    responses: {
+      /** @description Service health */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/json": {
+            ok: boolean;
+            service: string;
+            /** Format: date-time */
+            timestamp: string;
+          };
+        };
+      };
+    };
+  };
+  authAction: {
+    parameters: {
+      query?: never;
+      header?: never;
+      path: {
+        action: string;
+      };
+      cookie?: never;
+    };
+    requestBody?: never;
+    responses: {
+      /** @description Auth route (Better Auth handler) */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/json": Record<string, never>;
+        };
+      };
+    };
+  };
+}