fix: harden Perch for production

.github/dependabot.yml

@@ -0,0 +1,88 @@
+version: 2
+
+updates:
+  # Backend Node.js dependencies
+  - package-ecosystem: npm
+    directory: /backend
+    schedule:
+      interval: weekly
+      day: monday
+      time: "08:00"
+    open-pull-requests-limit: 10
+    reviewers: []
+    labels:
+      - dependencies
+      - backend
+    groups:
+      typescript-ecosystem:
+        patterns:
+          - "typescript"
+          - "tsx"
+          - "@types/*"
+      supabase:
+        patterns:
+          - "@supabase/*"
+      anthropic:
+        patterns:
+          - "@anthropic-ai/*"
+      openai:
+        patterns:
+          - "openai"
+      composio:
+        patterns:
+          - "@composio/*"
+
+  # Site Node.js dependencies
+  - package-ecosystem: npm
+    directory: /site
+    schedule:
+      interval: weekly
+      day: monday
+      time: "08:00"
+    open-pull-requests-limit: 10
+    labels:
+      - dependencies
+      - site
+    groups:
+      react-ecosystem:
+        patterns:
+          - "react"
+          - "react-dom"
+          - "@types/react*"
+          - "@vitejs/*"
+          - "vite"
+      tailwind:
+        patterns:
+          - "tailwindcss"
+          - "@tailwindcss/*"
+      testing:
+        patterns:
+          - "@playwright/*"
+          - "@axe-core/*"
+          - "playwright"
+
+  # GitHub Actions — pins SHAs; Dependabot updates SHA + comment together
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+      day: monday
+      time: "08:00"
+    open-pull-requests-limit: 10
+    labels:
+      - dependencies
+      - ci
+
+  # Swift Package Manager
+  # Note: Dependabot Swift support requires a Package.swift at the
+  # configured directory; if not present this entry is ignored gracefully.
+  - package-ecosystem: swift
+    directory: /app
+    schedule:
+      interval: weekly
+      day: monday
+      time: "08:00"
+    open-pull-requests-limit: 5
+    labels:
+      - dependencies
+      - swift

.github/workflows/ci.yml

@@ -0,0 +1,173 @@
+name: CI
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ci-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  backend-lint:
+    name: Backend — type-check
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+        with:
+          node-version: 24
+          cache: npm
+          cache-dependency-path: backend/package-lock.json
+      - working-directory: backend
+        run: npm ci
+      - name: Type-check (tsc --noEmit)
+        working-directory: backend
+        run: npx tsc --noEmit
+
+  backend-test:
+    name: Backend — unit tests
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+        with:
+          node-version: 24
+          cache: npm
+          cache-dependency-path: backend/package-lock.json
+      - working-directory: backend
+        run: npm ci
+      - name: Unit tests
+        working-directory: backend
+        run: npm test
+      - name: Runtime-policy gate (no child-process permission)
+        working-directory: backend
+        run: npm run test:runtime-policy
+
+  site-build:
+    name: Site — lint + build
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+        with:
+          node-version: 24
+          cache: npm
+          cache-dependency-path: site/package-lock.json
+      - working-directory: site
+        run: npm ci
+      - name: Lint
+        working-directory: site
+        run: npm run lint
+      - name: Build
+        working-directory: site
+        run: npm run build
+      - name: Upload built site
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: site-dist
+          path: site/dist
+          retention-days: 1
+
+  site-accessibility:
+    name: Site — accessibility (axe/WCAG 2.2 AA)
+    runs-on: ubuntu-latest
+    needs: site-build
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+        with:
+          node-version: 24
+          cache: npm
+          cache-dependency-path: site/package-lock.json
+      - working-directory: site
+        run: npm ci
+      - name: Download built site
+        uses: actions/download-artifact@65a9edc5881444af0b9093a5e628f2fe47ea3b2e # v4.1.7
+        with:
+          name: site-dist
+          path: site/dist
+      - name: Install Playwright browsers
+        working-directory: site
+        run: npx playwright install --with-deps chromium
+      - name: Run accessibility tests
+        working-directory: site
+        run: npm run test:a11y
+
+  swift-build:
+    name: Swift — test + build
+    runs-on: macos-26
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - name: Verify Swift and macOS SDK
+        run: swift --version && xcrun --sdk macosx --show-sdk-version
+      - working-directory: app
+        run: swift package resolve
+      - name: Lockfile integrity
+        working-directory: app
+        run: git diff --exit-code -- Package.resolved
+      - name: Swift test
+        working-directory: app
+        run: swift test
+      - name: Swift build
+        working-directory: app
+        run: swift build
+
+  migrations-verify:
+    name: Database — migration verify + RLS
+    runs-on: ubuntu-latest
+    services:
+      postgres:
+        image: postgres:17
+        env:
+          POSTGRES_PASSWORD: postgres
+        ports:
+          - 5432:5432
+        options: >-
+          --health-cmd "pg_isready -U postgres"
+          --health-interval 10s
+          --health-timeout 5s
+          --health-retries 5
+    env:
+      DATABASE_URL: postgresql://postgres:postgres@localhost:5432/postgres
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+        with:
+          node-version: 24
+          cache: npm
+          cache-dependency-path: backend/package-lock.json
+      - working-directory: backend
+        run: npm ci
+      - name: Apply migrations (idempotency check — run twice)
+        working-directory: backend
+        run: npm run db:migrate && npm run db:migrate
+      - name: Verify migrations read-only
+        working-directory: backend
+        run: npm run db:verify
+      - name: DB integration tests (RLS + isolation)
+        working-directory: backend
+        run: npm run test:db
+      - name: Schema snapshot drift
+        working-directory: backend
+        run: npm run db:snapshot && git diff --exit-code -- schema.sql
+
+  protocol-schema:
+    name: Protocol — schema compatibility
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+        with:
+          node-version: 24
+          cache: npm
+          cache-dependency-path: backend/package-lock.json
+      - working-directory: backend
+        run: npm ci
+      - name: Protocol schema tests
+        working-directory: backend
+        run: node --import tsx --test src/protocol/schemas.test.ts