feat(tooling): add project quality workflow

[gac0812]

Summary

• add a unified backend/frontend quality check script
• update the README, project structure, and dependency management documentation
• add development standards and Git hook templates
• restrict migration checks to an explicitly configured disposable PostgreSQL database
• run pre-commit checks against an exported snapshot of the Git index

Validation

• bash scripts/check-all.sh
• backend Ruff, formatting, mypy, and pytest passed (1 passed)
• frontend ESLint, Prettier, TypeScript, and dependency audit passed (0 vulnerabilities)
• hook templates passed bash -n
• exported pre-commit snapshot matched the index and differed from unstaged working-tree changes
• non-disposable database URLs and unreachable check databases both failed as expected
• Docker/PostgreSQL was unavailable locally, so a successful disposable-database migration run was not performed

[gemini-code-assist]

Caution

The consumer version of Gemini Code Assist on GitHub has been sunset. All code review activity has officially ceased.

[fennoai]

Review Summary

Found two correctness and safety issues in the new local quality workflow. I verified the shell syntax with bash -n scripts/check-all.sh and checked the patch with git diff --check; I did not run the full script because it can apply migrations to the configured database.

View job run

[fennoai]

P1 — Keep the quality gate from mutating or silently skipping database validation. Any exception from database_reachable (invalid URL, authentication failure, import/config error, not only an absent local PostgreSQL) is suppressed and lets the gate pass without migration checks. Conversely, when the URL is reachable, the next line runs alembic upgrade head against whatever TIMEAPP_DATABASE_URL is active, so invoking the documented pre-push hook can modify a staging or production database. Run this validation against an explicit disposable/local test database and fail on unexpected connection/setup errors.

[gac0812]

已在 007d1ae 修复。质量脚本不再探测或直接使用应用的 TIMEAPP_DATABASE_URL；只有显式提供 TIMEAPP_CHECK_DATABASE_URL 时才运行迁移检查，并要求 PostgreSQL 数据库名以 _test 或 _check 结尾。未配置时会明确警告；一旦配置，URL 解析、连接、认证或迁移错误都会使门禁失败。相关 README、依赖说明和开发规范已同步更新。已验证普通数据库名和不可达的测试数据库地址均会阻止门禁。请复核。