Add CI, a pre-commit hook, and an accessibility pass on the panel's own views

CI (.github/workflows/tests.yml) reuses docker-compose.test.yml verbatim for
the Postgres job rather than re-describing that environment in YAML, so the
Docker image stays the single source of truth for it.

Fixes a real mismatch found while wiring PHP versions into the workflow:
composer.json declared "php": "^8.3", but the locked Symfony packages require
>=8.4.1 — installing on 8.3 would fail at `composer install`, exactly what
the Dockerfile's own comment already warned about. Bumped the constraint and
resynced composer.lock's content-hash (no package versions changed).

The pre-commit hook (.githooks/pre-commit, activated via
`git config core.hooksPath` in post-autoload-dump) runs `pint --dirty --test`
and refuses to commit unformatted files rather than silently rewriting them.

The accessibility pass only touches this app's own hand-written Blade views,
not Filament's components: aria-hidden on icons that repeat adjacent text,
an aria-label on the one icon that is the only signal of a health check's
severity, rel="noopener" and a labelled announcement on preview links that
open in a new tab.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

.githooks/pre-commit

@@ -0,0 +1,25 @@
+#!/bin/sh
+set -e
+
+###############################################################################
+# Catches a formatting slip before it becomes a commit, rather than after —
+# by which point it is a CI failure and a second commit to fix it.
+#
+# Only checks files with uncommitted changes (`--dirty`), not the whole tree:
+# a hook that took as long as the full lint would be a hook people learn to
+# skip. Read-only on purpose too — it reports what Pint would change and
+# leaves fixing it to you, rather than silently rewriting a file you are
+# about to commit without your having seen the diff.
+#
+# Activated by `composer run setup` (`git config core.hooksPath .githooks`),
+# not by being physically inside .git/hooks/ — that directory is not tracked,
+# so a hook living only there is never shared with anyone else who clones
+# this repository.
+###############################################################################
+
+if ! ./vendor/bin/pint --dirty --test; then
+    echo >&2
+    echo "Pint found formatting issues in the files you are committing." >&2
+    echo "Run ./vendor/bin/pint --dirty to fix them, then stage and commit again." >&2
+    exit 1
+fi