ci: add Phase 1 CI workflow

[jcameronjeff]

Phase 1 CI for MCPAuthKit — adds .github/workflows/ci.yml (additive new file). Part of the org-wide CI/CD formalization; deploys unchanged.

Prerequisites

• package-lock.json is committed (verified present and tracked) so npm ci works

Cautions

• Bespoke workflow (not the reusable ci-node.yml) because this is a Cloudflare Worker validated via wrangler deploy --dry-run, which the reusable does not support.
• The npm test script (scripts/test-flow.sh) is an integration test that needs a live server + ADMIN_KEY; it is intentionally NOT run in CI (it would always fail on a clean runner). Run it manually against a deployed instance.
• wrangler deploy --dry-run --outdir dist only bundles/validates and does NOT need Cloudflare credentials (CLOUDFLARE_API_TOKEN / CLOUDFLARE_ACCOUNT_ID). If a future change adds bindings requiring remote lookups, the dry-run could start needing them; revisit then.
• applyVia is remote because src/worker.js is being edited by another agent in this worktree; the file must be added via the GitHub API to avoid touching their working tree.
• The SALT-pin guard greps wrangler.toml and fails the build if the [vars] SALT value differs from the literal change-me-to-a-random-string. Deliberate: rotating SALT invalidates every stored password hash, so it must only change as part of a coordinated password-hash migration, never as a drive-by edit.

Generated with Claude Code

https://claude.ai/code/session_01XD3eqvjHj4QckgL2iuj47u