ci(enforce): run the full gate in CI + add lefthook pre-commit + Knip

Pillar A enforcement so standards can't drift:
- .forgejo CI now runs format:check + lint (client+server) + typecheck
  (client) + typecheck:server, in addition to the existing check:server /
  tests / build. Previously lint and typecheck were NOT run in CI.
- lefthook pre-commit auto-formats staged files (prettier) + lints;
  pre-push typechecks. Auto-installed via the `prepare` script.
- Knip config (advisory `npm run knip`) for dead-code/unused-export
  review; the design-system ui/** is ignored to keep signal clean.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.forgejo/workflows/ci.yml

@@ -1,5 +1,6 @@
-# CI — syntax check, server tests (node:test), client tests (Vitest), Vite build.
-# Runs on every push and pull request so no change lands unverified.
+# CI — the FULL quality gate, so no change lands unverified: formatting,
+# lint (client + server), typecheck (client + server), server syntax check,
+# server + client tests, and the Vite build.
 #
 # Forgejo Actions reads .forgejo/workflows/. The container image matches the
 # Dockerfile runtime (node:22) so better-sqlite3 prebuilds resolve identically.
@@ -22,6 +23,18 @@ jobs:
       - name: Install dependencies
         run: npm ci
 
+      - name: Format check (Prettier)
+        run: npm run format:check
+
+      - name: Lint (client + server)
+        run: npm run lint
+
+      - name: Typecheck (client)
+        run: npm run typecheck
+
+      - name: Typecheck (server)
+        run: npm run typecheck:server
+
       - name: Syntax check (server)
         run: npm run check:server
 

knip.json

@@ -0,0 +1,23 @@
+{
+  "$schema": "https://unpkg.com/knip@6/schema.json",
+  "entry": [
+    "server.cts",
+    "client/main.tsx",
+    "workers/**/*.cts",
+    "scripts/*.{cts,js}",
+    "setup/*.cts",
+    "db/migrations/*.cts",
+    "tests/**/*.test.js",
+    "client/**/*.test.ts",
+    "e2e/**/*.{js,spec.js}",
+    "eslint.config.mjs",
+    "vite.config.mjs"
+  ],
+  "project": [
+    "client/**/*.{ts,tsx}",
+    "{routes,services,middleware,db,workers,utils,setup}/**/*.cts",
+    "server.cts"
+  ],
+  "ignore": ["client/components/ui/**", "types/**"],
+  "ignoreExportsUsedInFile": true
+}

lefthook.yml

@@ -0,0 +1,20 @@
+# Local fast enforcement so violations never reach CI.
+# Installed via the `prepare` script (`lefthook install`) on `npm install`.
+
+pre-commit:
+  parallel: false
+  jobs:
+    - name: format
+      glob: '*.{ts,tsx,cts,mts,js,jsx,json,md,css,yml,yaml}'
+      run: npx prettier --write {staged_files}
+      stage_fixed: true
+    - name: lint
+      run: npm run lint
+
+pre-push:
+  parallel: true
+  jobs:
+    - name: typecheck-client
+      run: npm run typecheck
+    - name: typecheck-server
+      run: npm run typecheck:server

package.json

@@ -26,7 +26,9 @@
     "test:e2e:update": "node e2e/setup/prepare-db.js && playwright test --project=chromium-desktop --project=chromium-mobile --update-snapshots",
     "test:e2e:probe": "node e2e/setup/prepare-db.js && playwright test --project=probe",
     "smoke:prod": "bash scripts/prod-smoke.sh",
+    "knip": "knip",
     "ci": "npm run format:check && npm run lint && npm run typecheck && npm run typecheck:server && npm run check:server && npm run test:all && npm run build",
+    "prepare": "lefthook install",
     "start": "node server.cts"
   },
   "dependencies": {
@@ -86,6 +88,8 @@
     "eslint-plugin-react-refresh": "^0.4.26",
     "globals": "^17.7.0",
     "jsdom": "^29.1.1",
+    "knip": "^6.24.0",
+    "lefthook": "^2.1.9",
     "postcss": "^8.4.47",
     "prettier": "3.9.4",
     "tailwindcss": "^3.4.14",