Tooling foundation: pin deps + biome baseline + CI wiring

[pablopunk]

Goal

Add Biome with a high-signal baseline and CI wiring, and replace "latest" dependency ranges with pinned semver (merged from #31).

Merged from

• Replace "latest" dependency ranges with pinned semver #31 — Replace "latest" dependency ranges with pinned semver

Why this matters

The repo has no linter or formatter (no eslint/biome/prettier config or dependency anywhere). Root package.json also pins ten packages to the literal range "latest", making builds non-reproducible. This issue establishes the tooling foundation: pin deps first, then add lint/format with a high-signal, low-noise Biome baseline.

To do

Phase 1: Pin dependencies (was #31)

• Read currently-resolved versions from pnpm-lock.yaml
• Replace each "latest" in root package.json with ^<resolved version>
• pnpm install — confirm lockfile stable (no major version moves)
• Verify: grep -c '"latest"' package.json → 0

Phase 2: Biome (was #32)

• Install: @biomejs/biome
• Create biome.json with formatter, linter, import organization, and sensible TypeScript/React ignores
• Add scripts: lint, lint:fix, format, format:check, and/or check backed by biome check
• Wire CI: add Biome check step to GitHub workflow
• Verify: pnpm lint exits 0, pnpm format:check exits 0, pnpm typecheck + pnpm test exit 0

Out of scope

• Mass-reformatting the repo (separate follow-up)
• Promoting warnings to errors / clearing any warnings (follow-up)
• Backend tooling changes

Verification

• mise exec -- pnpm lint → exit 0
• mise exec -- pnpm format:check → exit 0
• mise exec -- pnpm typecheck → exit 0
• mise exec -- pnpm test → exit 0