ci: phpstan baseline + GitHub Actions workflow (E5, E4)

E5: generate phpstan-baseline.neon (the 41 pre-existing errors) and include it,
so `phpstan analyse` returns OK and the gate now fails only on NEW errors. The
baseline is meant to be burned down over time.

E4: add .github/workflows/ci.yml — MariaDB 11.8 + redis services, composer
install, JWT keygen, phpstan (baseline-clean), migrate-on-empty-db smoke, and
phpunit. Locally verified the substantive checks: a fresh empty DB migrates
cleanly to 64 tables (guards the "migrations break on empty DB" bug class),
phpstan is green, and the 70-test suite passes. The GitHub Actions service
wiring itself is first-run-pending (can't be exercised offline).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

phpstan.neon

@@ -1,6 +1,9 @@
 includes:
     - vendor/phpstan/phpstan-symfony/extension.neon
     - vendor/phpstan/phpstan-doctrine/extension.neon
+    # Pre-existing errors are baselined (E5 in docs/audit-backlog.md) so the gate
+    # enforces "no NEW errors". Burn the baseline down over time.
+    - phpstan-baseline.neon
 
 parameters:
     level: 5