chore: set up branching, CI, and PR workflow

Prepares the repo for parallel agent work. No application code.

- CLAUDE.md: conventions, branch naming, and the six non-negotiable
  invariants from the design (immutable raw bytes, no stored odometers,
  SI integers, dual-layer user isolation, secret containment, single
  ingestion path). Also records a model-allocation policy: the
  orchestrator runs Opus 5, workers default to Sonnet, and Opus is
  reserved for review plus the areas where a mistake is silent and
  expensive (ingest, wear SQL, auth/RLS, the Bryton protocol client).
  And the Gitea Actions gotchas, so nobody rediscovers them:
  GITEA_TOKEN cannot push to the container registry, jobs.*.environment
  is ignored, and cron needs a workflow_dispatch pair.
- CONTRIBUTING.md: day-to-day flow, worktrees for parallel branches,
  review expectations.
- .gitea/workflows/ci.yml: repo hygiene (branch naming, secret scan,
  no ride data in git), plus API/web/migration jobs that guard on whether
  the code exists yet, so CI is meaningful now and grows into the real
  thing rather than being rewritten.
- .gitea/PULL_REQUEST_TEMPLATE.md: forces an honest "how this was
  verified" and an invariant checklist.
- scripts/pr.sh, scripts/review.sh: open and inspect PRs via the Gitea API.
- Directory scaffold with placeholder READMEs.

Agents open PRs; humans merge them.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

scripts/pr.sh

@@ -0,0 +1,58 @@
+#!/usr/bin/env bash
+# Open a pull request against main from the current branch.
+#
+#   scripts/pr.sh "feat(ingest): parse Bryton FIT activities" [--draft]
+#
+# Requires GITEA_TOKEN (scopes: write:repository, write:issue) and optionally GITEA_URL.
+set -euo pipefail
+
+GITEA_URL="${GITEA_URL:-http://192.168.0.3:3000}"
+OWNER="${GITEA_OWNER:-BBergle}"
+REPO="${GITEA_REPO:-bike-app}"
+BASE="${PR_BASE:-main}"
+
+die() { echo "error: $*" >&2; exit 1; }
+
+[ -n "${GITEA_TOKEN:-}" ] || die "GITEA_TOKEN is not set. See CONTRIBUTING.md."
+command -v jq >/dev/null || die "jq is required (brew install jq)."
+
+TITLE="${1:-}"
+[ -n "$TITLE" ] || die "usage: scripts/pr.sh \"<title>\" [--draft]"
+DRAFT=false
+[ "${2:-}" = "--draft" ] && DRAFT=true
+
+BRANCH="$(git rev-parse --abbrev-ref HEAD)"
+[ "$BRANCH" != "$BASE" ] || die "refusing to open a PR from $BASE onto itself."
+
+git diff --quiet && git diff --cached --quiet || die "working tree is dirty; commit or stash first."
+
+if ! git rev-parse --verify "origin/$BRANCH" >/dev/null 2>&1; then
+  echo "Branch not on the remote yet; pushing."
+  git push -u origin "$BRANCH"
+fi
+
+# Prefer the PR template; otherwise summarise the commits on this branch.
+if [ -f .gitea/PULL_REQUEST_TEMPLATE.md ]; then
+  BODY="$(cat .gitea/PULL_REQUEST_TEMPLATE.md)"
+else
+  BODY="$(git log --format='- %s' "origin/$BASE..$BRANCH")"
+fi
+
+RESPONSE="$(jq -n \
+  --arg title "$TITLE" --arg body "$BODY" \
+  --arg head "$BRANCH" --arg base "$BASE" \
+  --argjson draft "$DRAFT" \
+  '{title:$title, body:$body, head:$head, base:$base}' \
+  | curl -sS -X POST \
+      -H "Authorization: token $GITEA_TOKEN" \
+      -H "Content-Type: application/json" \
+      -d @- \
+      "$GITEA_URL/api/v1/repos/$OWNER/$REPO/pulls")"
+
+if URL="$(echo "$RESPONSE" | jq -er '.html_url' 2>/dev/null)"; then
+  echo "PR opened: $URL"
+else
+  echo "Gitea rejected the request:" >&2
+  echo "$RESPONSE" | jq . >&2 2>/dev/null || echo "$RESPONSE" >&2
+  exit 1
+fi