chore(ci): add CI workflow and Dependabot hardening

.github/dependabot.yml

@@ -0,0 +1,12 @@
+version: 2
+updates:
+  - package-ecosystem: pip
+    directory: /
+    schedule:
+      interval: weekly
+    labels: [dependencies]
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: monthly
+    labels: [dependencies, ci]

.github/workflows/ci.yml

@@ -0,0 +1,18 @@
+name: CI
+on:
+  push:
+    branches: [main, dev, 'feat/**', 'fix/**']
+  pull_request:
+    branches: [main, dev]
+jobs:
+  lint-and-test:
+    name: Ruff + Pytest
+    runs-on: ubuntu-latest
+    container:
+      image: python:3.13-slim
+    steps:
+      - run: apt-get update && apt-get install -y --no-install-recommends git
+      - uses: actions/checkout@v6
+      - run: pip install --no-cache-dir -r requirements.txt -r requirements-dev.txt
+      - run: ruff check --select ALL app/
+      - run: pytest --tb=short -q

requirements-dev.txt

@@ -2,3 +2,4 @@
 
 pytest==8.3.4
 pytest-asyncio==0.24.0
+ruff