feat: spec-compliance pass — auth guards, atomic writes, route fixes,…

.github/PULL_REQUEST_TEMPLATE.md

@@ -1 +1,37 @@
+## Summary
 
+<!-- One or two sentences: what does this PR do? -->
+
+## Motivation
+
+<!-- Why is this change needed? Link to issue / spec section if relevant. -->
+
+## Changes
+
+<!-- Bullet list of the concrete changes in this PR. -->
+-
+-
+
+## How was this tested?
+
+<!-- Did you run any of the following? Tick the ones that apply. -->
+- [ ] `npm run lint`
+- [ ] `npm run typecheck`
+- [ ] `npm run build`
+- [ ] Manual UI walkthrough (login → create → filter → edit → complete → delete → logout)
+- [ ] API smoke tests with `curl` (see README "REST API reference")
+
+## Checklist
+
+- [ ] Code follows the layer boundaries described in spec §1.4.1
+  (presentation never touches the filesystem directly).
+- [ ] New / changed API routes return appropriate HTTP status codes
+  (200 / 201 / 400 / 401 / 404).
+- [ ] Task routes still require the `prismtask_user` session cookie.
+- [ ] No secrets, credentials, or personal data added to the repository.
+- [ ] Commit messages follow Conventional Commits (`feat:` / `fix:` /
+  `refactor:` / `docs:` / `test:` / `chore:`).
+
+## Screenshots / recordings
+
+<!-- Optional — especially helpful for UI changes. -->

.github/workflows/ci.yml

@@ -1 +1,39 @@
+name: CI
 
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+jobs:
+  build:
+    name: Lint · Typecheck · Build
+    runs-on: ubuntu-latest
+
+    defaults:
+      run:
+        working-directory: frontend/prismtask
+
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@v4
+
+      - name: Set up Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: 20
+          cache: npm
+          cache-dependency-path: frontend/prismtask/package-lock.json
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Lint
+        run: npm run lint
+
+      - name: Typecheck
+        run: npm run typecheck
+
+      - name: Build
+        run: npm run build