feat: pre-prod hardening for security, workflow UI, and CI

Close validated pre-production gaps: cron bearer auth, rota FK validation,
RLS write-role policies, viewer read-only surgeries/templates, task amend
with compliance links, fetch error panels across app pages, PWA icons,
GitHub Actions CI, and expanded E2E coverage with reliable nurse login flow.

Co-authored-by: Cursor <cursoragent@cursor.com>

Author: tomal214

.env.example

@@ -8,3 +8,6 @@ NEXT_PUBLIC_SITE_URL=http://localhost:3000
 
 # Comma-separated emails allowed to access /platform
 PLATFORM_ADMIN_EMAILS=you@example.com
+
+# Edge function cron (daily task generation)
+CRON_SECRET=change-me-in-production

.github/workflows/ci.yml

@@ -0,0 +1,24 @@
+name: CI
+
+on:
+  push:
+    branches: [main, feat/**]
+  pull_request:
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: pnpm/action-setup@v4
+        with:
+          version: 10
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 20
+          cache: pnpm
+      - run: pnpm install --frozen-lockfile
+      - run: pnpm type-check
+      - run: pnpm test
+      - run: pnpm lint
+      - run: pnpm build