chore: set up branching, CI, and PR workflow

Prepares the repo for parallel agent work. No application code.

- CLAUDE.md: conventions, branch naming, and the six non-negotiable
  invariants from the design (immutable raw bytes, no stored odometers,
  SI integers, dual-layer user isolation, secret containment, single
  ingestion path). Also records a model-allocation policy: the
  orchestrator runs Opus 5, workers default to Sonnet, and Opus is
  reserved for review plus the areas where a mistake is silent and
  expensive (ingest, wear SQL, auth/RLS, the Bryton protocol client).
  And the Gitea Actions gotchas, so nobody rediscovers them:
  GITEA_TOKEN cannot push to the container registry, jobs.*.environment
  is ignored, and cron needs a workflow_dispatch pair.
- CONTRIBUTING.md: day-to-day flow, worktrees for parallel branches,
  review expectations.
- .gitea/workflows/ci.yml: repo hygiene (branch naming, secret scan,
  no ride data in git), plus API/web/migration jobs that guard on whether
  the code exists yet, so CI is meaningful now and grows into the real
  thing rather than being rewritten.
- .gitea/PULL_REQUEST_TEMPLATE.md: forces an honest "how this was
  verified" and an invariant checklist.
- scripts/pr.sh, scripts/review.sh: open and inspect PRs via the Gitea API.
- Directory scaffold with placeholder READMEs.

Agents open PRs; humans merge them.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

.gitea/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,27 @@
+## What and why
+
+<!-- What changed, and what problem it solves. Link the issue if there is one. -->
+
+## How this was verified
+
+<!-- Be specific and honest. "Ran the tests" is not enough — say which, and what they proved.
+     If something is untested, say so here rather than leaving the reviewer to find out. -->
+
+- [ ] CI is green
+- [ ] Tests added or updated for the behaviour that changed
+- [ ] Verified manually (describe how):
+
+## Invariants
+
+<!-- Tick only what applies to this change. See CLAUDE.md. -->
+
+- [ ] Raw ingested bytes remain immutable; derived tables stay rebuildable
+- [ ] No stored odometer added; wear still derived from installs
+- [ ] Physical quantities stored as SI integers
+- [ ] New user-owned tables have `user_id` + RLS policy + repository scope
+- [ ] No secret can reach a response model, log line, or error message
+- [ ] Migration survives `upgrade -> downgrade -1 -> upgrade`
+
+## Risks and follow-ups
+
+<!-- What might this break? What did you deliberately leave out? -->