BSL-67: CI/CD pipeline (GitHub Actions)

[rohanarcot]

BSL-67 — CI/CD

Adds GitHub Actions CI that runs on every PR to main, plus the ESLint config
and small fixes needed to make lint + build actually pass.

Changes

• .github/workflows/ci.yml (new) — CI on pull_request → main:
  checkout → Node 20 → npm ci --legacy-peer-deps → npx prisma generate →
  npm run lint → npm run build.
  • --legacy-peer-deps: react-simple-maps@3 pins React 18 while we run
    React 19, so plain npm ci fails peer resolution.
  • Ephemeral mongo:7 service container: the gallery pages query MongoDB
    during next build's static prerender, so the build needs a reachable DB.
    Queries just return empty sets — no real data/secrets in CI.
• .eslintrc.json (new) — the repo had no ESLint config, so npm run lint
  was unrunnable. Added next/core-web-vitals.
• .env.example — documented RESEND_API_KEY, BSL_ADMIN_EMAIL, and the
  production OAuth redirect URI.
• .gitignore — ignore .DS_Store.

Bug fixes (build was red on main)

• app/api/admin/applications/route.ts: imported @/generated/prisma/client,
  which is never generated → next build failed with "Cannot find module".
  Switched to @prisma/client, matching the other import sites.
• access-denied/page.tsx: escaped an apostrophe tripping
  react/no-unescaped-entities.

Verification

• npm run lint → exit 0
• npm run build (against a Mongo container) → exit 0

Follow-ups (not in this PR)

• Branch protection: require the Lint & Build check on main.
• CI runs npm run lint (ESLint), not lint-check — the latter's
  prettier --check fails on 82 unformatted files; a repo-wide prettier --write
  should land as its own chore PR.

[gavinlin24]

One fix that lives outside this PR's files: CLAUDE.md still tells people to import from @/generated/prisma/client, the exact broken path you just fixed. That path doesn't get generated anymore, so the guide will lead the next person (or an AI assistant) to put this bug right back in. Worth a quick one-line update to @prisma/client.

One more note inline on ci.yml.

[gavinlin24]

Both follow-ups from the earlier review are handled in c5de4a5:

• CLAUDE.md now documents @prisma/client (no more @/generated/prisma/client).
• The ci.yml comment names the actual "Lint & Build" check.

I verified the pipeline builds green earlier, so approving.

Note, separate from this PR: the deployment work (Vercel, Atlas, Google OAuth in production) and enabling branch protection on main still need to happen before BSL-67 is fully complete.