chore: add CI pipeline, Dependabot, and 100% coverage enforcement

.github/dependabot.yml

@@ -0,0 +1,50 @@
+version: 2
+updates:
+  # Check for updates to frontend npm dependencies
+  - package-ecosystem: 'npm'
+    directory: '/'
+    schedule:
+      interval: 'weekly'
+    open-pull-requests-limit: 3
+    groups:
+      dependencies-minor-patch:
+        patterns:
+          - '*'
+        update-types:
+          - 'minor'
+          - 'patch'
+      dependencies-major:
+        patterns:
+          - '*'
+        update-types:
+          - 'major'
+
+  # Check for updates to Rust/Cargo dependencies
+  - package-ecosystem: 'cargo'
+    directory: '/src-tauri'
+    schedule:
+      interval: 'weekly'
+    open-pull-requests-limit: 3
+    groups:
+      dependencies-minor-patch:
+        patterns:
+          - '*'
+        update-types:
+          - 'minor'
+          - 'patch'
+      dependencies-major:
+        patterns:
+          - '*'
+        update-types:
+          - 'major'
+
+  # Check for updates to GitHub Actions
+  - package-ecosystem: 'github-actions'
+    directory: '/'
+    schedule:
+      interval: 'weekly'
+    open-pull-requests-limit: 3
+    groups:
+      github-actions:
+        patterns:
+          - '*'

.github/workflows/pr-backend-tests.yml

@@ -0,0 +1,34 @@
+name: Backend Tests
+
+on:
+  workflow_call:
+    inputs:
+      head_ref:
+        description: 'The head ref of the PR'
+        required: false
+        type: string
+
+jobs:
+  test:
+    name: Backend Tests
+    runs-on: macos-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4.3.1
+        with:
+          ref: ${{ inputs.head_ref || github.head_ref }}
+          fetch-depth: 1
+
+      - name: Install nightly Rust toolchain
+        run: rustup toolchain install nightly-2026-03-30 --component llvm-tools --no-self-update
+
+      - name: Install cargo-llvm-cov
+        uses: taiki-e/install-action@899b013517f9e7774591216672bf75a46bb9a481  # v2.9.4
+        with:
+          tool: cargo-llvm-cov
+
+      - name: Run backend tests with coverage
+        working-directory: src-tauri
+        run: |
+          echo "Running Cargo tests with 100% line coverage enforcement..."
+          cargo +nightly-2026-03-30 llvm-cov --ignore-filename-regex "(lib|main)\.rs" --fail-under-lines 100

.github/workflows/pr-build-validation.yml

@@ -0,0 +1,42 @@
+name: Build Validation
+
+on:
+  workflow_call:
+    inputs:
+      head_ref:
+        description: 'The head ref of the PR'
+        required: false
+        type: string
+
+jobs:
+  build:
+    name: Build Validation
+    runs-on: macos-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4.3.1
+        with:
+          ref: ${{ inputs.head_ref || github.head_ref }}
+          fetch-depth: 1
+
+      - name: Setup Bun
+        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6  # v2.2.0
+        with:
+          bun-version: 1.3.11
+
+      - name: Install dependencies
+        run: bun install --frozen-lockfile
+
+      - name: Security vulnerability scan
+        run: |
+          AUDIT=$(bun audit 2>&1 || true)
+          echo "$AUDIT"
+          if echo "$AUDIT" | grep -qE '\b(critical|high)\b'; then
+            echo "::error::High or critical severity vulnerabilities found. Fix before merging."
+            exit 1
+          fi
+
+      - name: Build validation
+        run: |
+          echo "Running full build validation (lint, format, typecheck, frontend + Tauri build)..."
+          bun run validate-build

.github/workflows/pr-frontend-tests.yml

@@ -0,0 +1,33 @@
+name: Frontend Tests
+
+on:
+  workflow_call:
+    inputs:
+      head_ref:
+        description: 'The head ref of the PR'
+        required: false
+        type: string
+
+jobs:
+  test:
+    name: Frontend Tests
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4.3.1
+        with:
+          ref: ${{ inputs.head_ref || github.head_ref }}
+          fetch-depth: 1
+
+      - name: Setup Bun
+        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6  # v2.2.0
+        with:
+          bun-version: 1.3.11
+
+      - name: Install dependencies
+        run: bun install --frozen-lockfile
+
+      - name: Run frontend tests with coverage
+        run: |
+          echo "Running Vitest with 100% coverage threshold..."
+          bun run test:coverage

.github/workflows/pr-pipeline.yml

@@ -0,0 +1,33 @@
+name: PR Pipeline
+
+on:
+  pull_request:
+    branches: [main]
+  workflow_dispatch:
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+  pull-requests: write
+
+jobs:
+  build-validation:
+    name: Build Validation
+    uses: ./.github/workflows/pr-build-validation.yml
+    with:
+      head_ref: ${{ github.head_ref }}
+
+  frontend-tests:
+    name: Frontend Tests
+    uses: ./.github/workflows/pr-frontend-tests.yml
+    with:
+      head_ref: ${{ github.head_ref }}
+
+  backend-tests:
+    name: Backend Tests
+    uses: ./.github/workflows/pr-backend-tests.yml
+    with:
+      head_ref: ${{ github.head_ref }}