Add CI, a pre-commit hook, and an accessibility pass on the panel's own views

CI (.github/workflows/tests.yml) reuses docker-compose.test.yml verbatim for
the Postgres job rather than re-describing that environment in YAML, so the
Docker image stays the single source of truth for it.

Fixes a real mismatch found while wiring PHP versions into the workflow:
composer.json declared "php": "^8.3", but the locked Symfony packages require
>=8.4.1 — installing on 8.3 would fail at `composer install`, exactly what
the Dockerfile's own comment already warned about. Bumped the constraint and
resynced composer.lock's content-hash (no package versions changed).

The pre-commit hook (.githooks/pre-commit, activated via
`git config core.hooksPath` in post-autoload-dump) runs `pint --dirty --test`
and refuses to commit unformatted files rather than silently rewriting them.

The accessibility pass only touches this app's own hand-written Blade views,
not Filament's components: aria-hidden on icons that repeat adjacent text,
an aria-label on the one icon that is the only signal of a health check's
severity, rel="noopener" and a labelled announcement on preview links that
open in a new tab.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

.github/workflows/tests.yml

@@ -0,0 +1,81 @@
+name: Tests
+
+# Every push and every pull request, on any branch — a failure is cheapest to
+# find here, before it is a review comment or, worse, a deploy.
+on:
+  push:
+  pull_request:
+
+# A second push to the same branch cancels whatever this workflow was still
+# running for the first one: nobody is waiting on results for code that no
+# longer exists.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+env:
+  # Real PHP requirement per composer.lock, not the ^8.3 composer.json used to
+  # claim — the locked Symfony packages require >=8.4.1, so 8.3 fails at
+  # `composer install`, and this pins the version the Dockerfile already
+  # settled on rather than re-deriving it.
+  PHP_VERSION: "8.4"
+  # A throwaway key, checked into no secret store because it protects nothing
+  # here: sessions and signed URLs in a CI run that is discarded on exit.
+  # docker-compose.test.yml uses this exact value for the same reason.
+  APP_KEY: "base64:AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA="
+
+jobs:
+  # Fast and dependency-free: catches a formatting slip before anything as
+  # slow as booting the framework runs at all.
+  lint:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: shivammathur/setup-php@v2
+        with:
+          php-version: ${{ env.PHP_VERSION }}
+          tools: composer:v2
+          coverage: none
+
+      - uses: ramsey/composer-install@v3
+
+      - run: ./vendor/bin/pint --test
+
+  # SQLite, in memory: the fast loop, for feedback in the couple of minutes it
+  # actually takes. Postgres is what production runs on, which is what the
+  # job below is for.
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: shivammathur/setup-php@v2
+        with:
+          php-version: ${{ env.PHP_VERSION }}
+          extensions: pdo_sqlite, pdo_pgsql, gd, exif, intl, zip, pcntl, opcache
+          tools: composer:v2
+          coverage: none
+
+      - uses: ramsey/composer-install@v3
+
+      - run: php artisan test
+
+      # Fails if public/api-types.d.ts was committed out of step with
+      # openapi.yaml — the one artefact in this repo that is generated and
+      # checked in rather than built at deploy time, so nothing else would
+      # ever notice it drifting.
+      - run: php artisan api:types --check
+
+  # The one this app's own README insists on before trusting a change: this
+  # project stores translations and image variants in JSON columns and
+  # queries them by path in about forty places, and SQLite and Postgres do
+  # not always agree on what that means. Reuses docker-compose.test.yml
+  # verbatim rather than re-describing the same environment in YAML a second
+  # time — one place to keep it correct.
+  test-postgres:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - run: docker compose -f docker-compose.test.yml run --rm test