PRs run no test/lint/type gate; backend pytest never runs in CI

[Muawiya-contact]

Coordination with #169 — 2026-09-25: Included in full in the single implementation PR tracked by #169: backend/mobile application checks on PRs, meaningful failure gates and verified required-check enforcement. A release-guard PR workflow now exists, so the historical claim of no PR checks is outdated; general application gates remain the work to verify/complete. Reuse existing Node tests and release checks, without a parallel CI implementation PR.

Problem
Quality gates are effectively post-merge. develop (the default branch where all work lands) gets no required CI on PRs.

Evidence

• Of the workflows, only migrations.yml has a pull_request trigger, and it targets main only.
• audit.yml runs tsc (mobile typecheck) + ruff (bug-only F,E9) — but weekly + on push to main (i.e. after merge), and it files issues rather than failing the merge.
• backend/tests has 84 test functions, but pytest is never run in any workflow.
• Mobile has 0 tests and no lint script; there is no ESLint/Prettier config. CONTRIBUTING.md tells contributors to run linters that don’t exist.

Impact — Type/logic regressions into develop are only caught weekly or after they’ve reached main (and thus production OTA). The 84 backend tests are decorative from a CI standpoint.

Suggested direction — Add a pull_request CI job (into develop and main) running tsc --noEmit, backend pytest, and lint as required checks. The selection tests need podman (conftest.py), but token/generation/API tests run offline and should gate every PR. Add an ESLint/Prettier config so the CONTRIBUTING guidance is real.