ci: core CI workflow — parallel backend + frontend, fail-fast (R1)

[g9shubh]

Round 1 — Foundations (CI/CD)

Adds the core CI pipeline both R1–R4 build on. Backend and frontend jobs run
in parallel and fail-fast, so every PR now gets a green/red signal on both stacks.

What's in here

.github/workflows/ci.yml — two parallel jobs:

🔧 backend (.NET 10)

• restore → build (Release) → test
• Runs the 4 correctness projects: Domain, Data, Service, Api
• Performance.Tests is excluded from the blocking gate (Round 0 decision — perf is not a day-one PR gate)
• bash -eo pipefail → first failing project stops the job (fail-fast)

🔧 frontend (Angular 22)

• npm ci → npm run build → npx ng test --watch=false (Vitest, headless jsdom)

Design notes

• Parallel: no needs: between the two jobs → they run concurrently.
• Fail-fast: concurrency: cancel-in-progress cancels superseded runs on the same ref.
• Triggers: every pull_request + pushes to main.
• Least privilege: permissions: contents: read.

Verification

• ✅ Backend builds + 4 test projects green locally (dotnet build/test -c Release)
• ✅ Frontend builds (npm run build) + ng test --watch=false passes (~134 tests)
• ⚠️ FE build emits non-blocking budget/CommonJS warnings (shell/provisioning CSS, jszip) — warnings only, build exits 0

Post-merge (R1 boundary)

After this + Akash's transport-hardening PR merge, enable BASIC branch protection on main:
require green CI (backend, frontend) + 1 review. Tighten (CODEOWNERS, all branches) in R5.

Refs: DocAnalytics Security & CI/CD Round Split (Revised) — Round 1