ci(web): run lint, test and build on every pull request

[Bugs5382]

Closes #99. Second of two: #100 fixed the break, this is the gate that would
have caught it.

What and why

Nothing in this repo was running lint, test or build. The checks were
licenses, PR hygiene, gitleaks and actionlint — so a pull request could be
green against a main that did not compile.

That is not hypothetical. #98 merged green and broke the production build; it
surfaced days later when the 1670 FleetOS host could not be rebuilt.

All three run, not one of them, because each catches what the others miss:

• vitest run does not typecheck.
• tsc -b runs only inside npm run build.

So a type error in a test file passes the suite and fails the production
build. That is exactly the shape of #99.

Two smaller choices:

• npm ci, not npm install — installs exactly the lockfile and fails
  when package.json and the lockfile disagree, rather than quietly passing
  against a dependency tree nobody else has.
• A tree-clean check at the end — catches a formatter or generated file
  that rewrites something in place, which would otherwise pass and surprise
  the next person.

Verification

• Lint clean
• Tests pass
• Build succeeds

How this was verified

Every step the workflow runs was run locally in the same order, including the
npm ci that CI will do:

npm ci          # lockfile in sync
npm run lint    # eslint + prettier clean
npm run test    # 66 files, 287 tests
npm run build   # tsc -b && vite build, succeeds
git status      # clean
actionlint .github/workflows/ci-web.yml

Merge order

After #100, which is already merged. The gate would otherwise fail on its own
first run.

One thing worth a second opinion

The job pins Node 22 LTS. The repo declares no engines range, so that pin
becomes the de facto statement of what the project builds on — and it is not
what is on my workstation (24). If 22 is the wrong target, this is the line to
change.

[Bugs5382]

Adds .github/workflows/ci-web.yml: npm ci, npm run lint, npm run test, npm run build, then a tree-clean check. The new Web validation (lint, test, build) check ran on this PR and passed in 59s, so the gate is live rather than merely configured.

Every step was run locally in the same order first, including npm ci (lockfile in sync), and actionlint on the workflow.

This closes #99 with the break already fixed in #100, so the gate did not fail on its own first run. Worth flagging for review: the job pins Node 22 LTS, and since the repo declares no engines range that pin becomes the de facto build target. It is not what is on my workstation (24).