ci(r0.12): pipeline GitHub Actions — ci-contract, api (couverture ≥ 70 %), web

- ci-contract : régénère docs/openapi.json + schema.d.ts et échoue au
  moindre diff — la règle d'or (ADR-001) devient bloquante
- api : services PostgreSQL 18 + Redis, prisma migrate deploy, typecheck,
  Jest avec coverageThreshold global 70 % (mesuré : 97,5 % stmts / 90,7 % branches)
- web : typecheck + vitest + build de production
- test unitaire PermissionsGuard (23 tests au total) ; badge CI au README

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

.github/workflows/ci.yml

@@ -0,0 +1,95 @@
+# CI SIOP V2 (R0.12) — trois verrous :
+#   ci-contract : la règle d'or (Zod → OpenAPI → clients typés) — échoue au
+#                 moindre diff entre le contrat committé et la génération ;
+#   api         : migration + tests Jest (couverture ≥ 70 % bloquante, jest.config) ;
+#   web         : typecheck + vitest + build de production.
+# Le parcours Playwright (connexion démo → coquille) complétera R0.12.
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+concurrency:
+  group: ci-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  contract:
+    name: ci-contract (règle d'or)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: pnpm/action-setup@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version-file: .nvmrc
+          cache: pnpm
+      - run: pnpm install --frozen-lockfile
+      - run: pnpm --filter @siop/shared build
+      - name: Régénérer la spec et le client typé
+        run: |
+          pnpm --filter @siop/shared contract
+          pnpm --filter @siop/web generate:client
+      - name: Vérifier qu'aucun artefact ne dérive du contrat
+        run: |
+          if ! git diff --exit-code -- docs/openapi.json apps/web/src/api/schema.d.ts; then
+            echo "::error::Contrat désynchronisé — régénérez spec et clients dans le même commit (pnpm contract && pnpm --filter @siop/web generate:client)."
+            exit 1
+          fi
+
+  api:
+    name: api (tests + couverture ≥ 70 %)
+    runs-on: ubuntu-latest
+    services:
+      # R0 : PostgreSQL nu suffit (r0_identity). Dès que des tests exigeront
+      # pgvector/PostGIS (R1+), passer sur l'image infra/postgres.
+      postgres:
+        image: postgres:18
+        env:
+          POSTGRES_USER: siop
+          POSTGRES_PASSWORD: siop
+          POSTGRES_DB: siop
+        ports: ['5432:5432']
+        options: >-
+          --health-cmd "pg_isready -U siop -d siop"
+          --health-interval 5s --health-timeout 3s --health-retries 10
+      redis:
+        image: redis:7.4-alpine
+        ports: ['6379:6379']
+        options: >-
+          --health-cmd "redis-cli ping"
+          --health-interval 5s --health-timeout 3s --health-retries 10
+    env:
+      DATABASE_URL: postgresql://siop:siop@localhost:5432/siop
+      REDIS_URL: redis://localhost:6379
+      JWT_SECRET: ci-only-secret-0123456789abcdef
+    steps:
+      - uses: actions/checkout@v4
+      - uses: pnpm/action-setup@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version-file: .nvmrc
+          cache: pnpm
+      - run: pnpm install --frozen-lockfile
+      - run: pnpm --filter @siop/shared build
+      - run: pnpm --filter @siop/api prisma:generate
+      - run: pnpm --filter @siop/api exec prisma migrate deploy
+      - run: pnpm --filter @siop/api typecheck
+      - run: pnpm --filter @siop/api test:cov
+
+  web:
+    name: web (typecheck + tests + build)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: pnpm/action-setup@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version-file: .nvmrc
+          cache: pnpm
+      - run: pnpm install --frozen-lockfile
+      - run: pnpm --filter @siop/shared build
+      - run: pnpm --filter @siop/web test
+      - run: pnpm --filter @siop/web build