Admin: Integrate lint, build, unit, and component checks into monorepo CI

[gekichumai-admin]

Phase / step: Phase 5 — Security and quality / Step 3
Parent: #301
Depends on: #312

Context and goal

The new workspace must receive the same pull-request protection as existing applications, with frontend-specific tests that catch authorization presentation bugs and dense-table regressions before deployment.

Scope and implementation notes

• Register the admin package with root/Turbo lint, format-check, type-check, test, and production-build tasks using pnpm and the repository's existing oxlint/oxfmt conventions.
• Configure Vitest with a browser-like DOM and React Testing Library for route, provider, form, table, drawer, and mutation-state component tests.
• Add reusable fixtures/builders for ordinary user, administrator, super-administrator, banned user, unknown provenance, historical-incomplete provenance, and representative API failures.
• Require tests for authorization state presentation, URL filter serialization, loading/empty/stale/error states, step-up expiry, destructive-action confirmation, query invalidation, and sensitive-data redaction.
• Run checks on pull requests that affect apps/admin, its shared contracts/packages, root lock/configuration, or backend endpoints consumed by the app. A safe full-monorepo fallback is acceptable when change detection is ambiguous.
• Build using placeholder/non-secret public configuration and fail when required public environment variables are missing or malformed. Ensure no protected credential is bundled.
• Publish concise test/build diagnostics as CI artifacts while excluding environment dumps, auth state, report/comment fixtures containing realistic personal data, and source maps intended for protected upload.
• Add dependency-boundary verification preventing accidental MUI/UnoCSS/PostHog imports into the admin app.

Acceptance criteria

• Root lint, format check, type check, tests, and build include apps/admin and pass from a clean install.
• Pull requests affecting the app or its contracts cannot merge when required checks fail.
• Component test helpers isolate Query Client/cache state and mock authentication deterministically.
• Representative authorization, query, form, table/drawer, step-up, and error states have automated coverage.
• CI production builds use no real credentials and verify that protected values are absent from generated assets.
• Test artifacts and logs contain no realistic PII, credentials, raw evidence, or internal moderation reasons.
• An automated boundary check rejects MUI, UnoCSS, and PostHog imports in apps/admin.
• The workflow uses pnpm and existing repository formatting/linting tools rather than adding parallel toolchains.

Out of scope

• Browser end-to-end testing, tracked separately.
• Deployment or preview publication.
• A repository-wide test-framework migration.
• Enforcing frontend coverage percentages unrelated to risk.