fix(ci): drop paths-filter negation patterns that fire on docs-only PRs (#61)

dorny/paths-filter standalone negation patterns (`'!apps/api/**/*.md'`
and the like) don't behave like exclude-from-include rules — they
evaluate to true for ANY changed file that doesn't fit the inverse
pattern. Net effect: on a docs-only PR with no code touched, the
`code` filter still returned `true` because a docs `.mdx` file
doesn't match `apps/api/**/*.md`, so the negation "matched".

Concrete evidence: PR #58 (only changed `apps/docs/.../deployment.mdx`).
Every step in `apps-api-ci.yml`'s `validate` job ran — checkout,
filter, Bun, install, db migrations, full test suite, coverage,
production bundle. The buggy negation set `Filter code = true`, the
internal `if: steps.filter.outputs.code == 'true'` gates all
short-circuited to "run", and we hit a unit-test flake on a PR that
touched zero application code.

Removed the negation lines from all 10 affected workflows. The filter
now matches strictly on the positive paths (`apps/api/**`, `apps/ui/**`,
etc. + the workflow file itself). Trade-off: a `README.md` change
inside `apps/api/` will now trigger api-ci. That's acceptable — those
changes are rare, and the previous "fast-skip" optimisation wasn't
actually working anyway. Net effect on docs-only PRs: api-ci,
ui-validate, smoke, bootstrap-validate, validate-compose, and the
security workflows all now correctly skip-with-success in ~30 s
instead of running their full pipelines.

Files touched (10 workflows, 22 lines deleted):
  apps-api-ci.yml
  apps-api-security-{deps,sast,secrets}.yml
  apps-ui-security-{deps,sast,secrets}.yml
  apps-ui-validate.yml
  infra-bootstrap-validate.yml
  infra-compose-full-stack-smoke.yml
  infra-compose-validate-compose.yml  (3 filter blocks)

This PR self-verifies: it's workflow-only, so the `code` filter on
every affected workflow should now correctly evaluate to `false` on
this PR (no apps/api, apps/ui, infra/* changes), and the heavy jobs
should report quick green via skip-with-success. If you see Bun
install + full test suite running on this PR, the fix is wrong.

Author: agjs

.github/workflows/apps-api-ci.yml

@@ -85,8 +85,6 @@ jobs:
           filters: |
             code:
               - 'apps/api/**'
-              - '!apps/api/**/*.md'
-              - '!apps/api/**/*.mdx'
               - '.github/workflows/apps-api-ci.yml'
 
       - name: Set up Bun

.github/workflows/apps-api-security-deps.yml

@@ -42,8 +42,6 @@ jobs:
           filters: |
             code:
               - 'apps/api/**'
-              - '!apps/api/**/*.md'
-              - '!apps/api/**/*.mdx'
               - '.github/workflows/apps-api-security-deps.yml'
 
       - name: Install osv-scanner CLI

.github/workflows/apps-api-security-sast.yml

@@ -55,8 +55,6 @@ jobs:
           filters: |
             code:
               - 'apps/api/**'
-              - '!apps/api/**/*.md'
-              - '!apps/api/**/*.mdx'
               - '.github/workflows/apps-api-security-sast.yml'
 
       - name: Compute baseline

.github/workflows/apps-api-security-secrets.yml

@@ -46,8 +46,6 @@ jobs:
           filters: |
             code:
               - 'apps/api/**'
-              - '!apps/api/**/*.md'
-              - '!apps/api/**/*.mdx'
               - '.github/workflows/apps-api-security-secrets.yml'
 
       - name: Install gitleaks CLI

.github/workflows/apps-ui-security-deps.yml

@@ -42,8 +42,6 @@ jobs:
           filters: |
             code:
               - 'apps/ui/**'
-              - '!apps/ui/**/*.md'
-              - '!apps/ui/**/*.mdx'
               - '.github/workflows/apps-ui-security-deps.yml'
 
       - name: Install osv-scanner CLI

.github/workflows/apps-ui-security-sast.yml

@@ -54,8 +54,6 @@ jobs:
           filters: |
             code:
               - 'apps/ui/**'
-              - '!apps/ui/**/*.md'
-              - '!apps/ui/**/*.mdx'
               - '.github/workflows/apps-ui-security-sast.yml'
 
       - name: Compute baseline

.github/workflows/apps-ui-security-secrets.yml

@@ -46,8 +46,6 @@ jobs:
           filters: |
             code:
               - 'apps/ui/**'
-              - '!apps/ui/**/*.md'
-              - '!apps/ui/**/*.mdx'
               - '.github/workflows/apps-ui-security-secrets.yml'
 
       - name: Install gitleaks CLI

.github/workflows/apps-ui-validate.yml

@@ -34,8 +34,6 @@ jobs:
           filters: |
             code:
               - 'apps/ui/**'
-              - '!apps/ui/**/*.md'
-              - '!apps/ui/**/*.mdx'
               - '.github/workflows/apps-ui-validate.yml'
 
       - name: Set up Bun

.github/workflows/infra-bootstrap-validate.yml

@@ -30,7 +30,6 @@ jobs:
           filters: |
             code:
               - 'infra/bootstrap/**'
-              - '!infra/bootstrap/**/*.md'
               - '.github/workflows/infra-bootstrap-validate.yml'
 
       - name: Install OpenTofu

.github/workflows/infra-compose-full-stack-smoke.yml

@@ -59,8 +59,6 @@ jobs:
               - 'apps/api/**'
               - 'apps/ui/**'
               - 'infra/compose/**'
-              - '!**/*.md'
-              - '!**/*.mdx'
               - '.github/workflows/infra-compose-full-stack-smoke.yml'
 
       - name: Seed compose/.env