Add the QA foundation: test pyramid, test-case catalog, CI

[dnk8n]

Test suites (no application code touched; all verified green locally):

• tests/db: pgTAP, 87 assertions across schema/role invariants, constraints and triggers, auth.* functions, RLS per persona (SET ROLE), and pm/lead grant-revoke automation. Each file is a transaction that rolls back; pgTAP is apt-installed into the running container at test time so the production image stays untouched.
• tests/api: Vitest + jose, 40 tests driving PostgREST with per-persona HS256 debug JWTs: auth, employees, projects, teams, reference data, time tracking, FAQs, plots, and the ra-data-postgrest query contract.
• tests/e2e: Playwright, 8 specs: debug login/logout, unknown-user rejection, the AoW->activity->project->log-time journey through the cascading selects, dashboard render.

Test cases and policy:

• docs/test-cases.md: natural-language catalog; every automated test cites a TC-id, enforced by tests/check-test-case-ids.sh in CI
• docs/testing.md: strategy, how to run, design self-review, and the defects pinned by expected-fail tests

Three genuine bugs were found and are committed as expected failures (pgTAP todo / vitest test.fails), per policy - not fixed:

• TC-RLS-012/TC-PROJ-105: select_projects_policy lacks FOR SELECT, so any project member can update the project
• TC-EMP-106: employees cannot self-update their profile (only power has INSERT on auth.users, which employees_upsert requires)
• TC-SEC-001: aoe_teams_grant_or_revoke_privs is executable by basic

CI (.github/workflows/ci.yml): lint job (UI type-check/eslint/prettier in check mode, pre-commit, TC-id check) and stack-tests job (boots the real compose stack, runs pgTAP -> API -> E2E, uploads traces and compose logs on failure). Make targets: test, test-db, test-api, test-e2e.