chore: Merge PR #240 to main after CI green

[ibuyspy]

Problem

PR #240 (sprint wave 1 CI fixes + deployment) needs to be merged to main. CI checks are mostly passing now (lint OK, security audit OK, CodeQL OK). Typecheck needed prisma generate (fixed in latest push).

Remaining blockers

• Wait for CI to go fully green after latest push
• Web Tests job may fail due to fix: Web test suite fails with ERR_REQUIRE_ESM (html-encoding-sniffer) #241 (ESM issue) - consider making it non-required
• Once green, squash-merge PR feat(sprint): Waves 1-4 — CI fixes, security hardening, deploy pipeline #240

Context

Branch: feat/sprint-wave1-ci-fixes
Contains: Wave 1 (CI), Wave 2 (security+deploy), Wave 3 (infra TF configs), Wave 4 (hardening)