chore: improve tooling, linting, testing, and CI

- Add LICENSE file (CC BY-NC-SA 4.0)
- Add .nvmrc pinning Node 22
- Add Renovate config with daily schedule and Gitea Actions workflow
- Reduce ESLint max-warnings from 1000 to 50
- Re-enable Biome a11y/security recommended rules
- Fix Biome lint issues (a11y, hook deps, SVG labels, checkbox semantics)
- Improve CI: run on pushes to feat/fix branches, add pnpm audit
- Add Vitest coverage with v8 provider and thresholds
- Add E2E tests (auth, admin, navigation specs)
- Add admin-maintenance server action test
- Install @vitest/coverage-v8
- Ignore coverage/ directory

.gitea/workflows/ci.yaml

@@ -1,5 +1,10 @@
 name: CI
 on:
+  push:
+    branches:
+      - main
+      - "feat/**"
+      - "fix/**"
   pull_request:
     branches:
       - main
@@ -8,7 +13,7 @@ jobs:
   check:
     runs-on: shell
     steps:
-      - name: Typecheck, lint, and test
+      - name: Typecheck, lint, security audit, and test
         run: |
           set -e
           WORK="$(mktemp -d /var/tmp/epicnext-ci.XXXXXX)"
@@ -35,6 +40,7 @@ jobs:
           export BCRYPT_ROUNDS=4
           pnpm install --frozen-lockfile
           pnpm prisma:generate
+          pnpm audit --audit-level=high || echo "WARNING: pnpm audit found high/critical vulnerabilities"
           pnpm biome:lint
           pnpm typecheck
           pnpm test

.gitea/workflows/renovate.yaml

@@ -0,0 +1,22 @@
+name: Renovate
+on:
+  schedule:
+    - cron: "0 5 * * *" # every day at 05:00
+  workflow_dispatch: # manual trigger
+
+jobs:
+  renovate:
+    runs-on: shell
+    steps:
+      - name: Self-hosted Renovate
+        run: |
+          set -e
+          docker run --rm \
+            -e RENOVATE_TOKEN="${{ secrets.RENOVATE_TOKEN }}" \
+            -e RENOVATE_AUTODISCOVER=false \
+            -e RENOVATE_REPOSITORIES="${{ gitea.repository }}" \
+            -e RENOVATE_ONBOARDING=false \
+            -e RENOVATE_CONFIG_FILE='{"extends":["config:recommended"]}' \
+            -e LOG_LEVEL=info \
+            -v /var/tmp/renovate-cache:/tmp/renovate-cache \
+            ghcr.io/renovatebot/renovate:latest