CI: cargo clippy -D warnings + cargo test + flutter analyze + flutter test

[ermeme]

Milestone: 2 — CI / infra base
Type: infra / ci
Priority: high

The repo has no .github/workflows/. The README claims "All CI checks must pass before merging" but the gate does not exist. docs/BRANCH_PROTECTION.md describes the desired state.

Scope

• New .github/workflows/ci.yml with jobs:
  • Rust: cargo build, cargo test, cargo clippy -- -D warnings.
  • Flutter: flutter pub get, flutter analyze, flutter test.
• Cache ~/.cargo, target/, and ~/.pub-cache for speed.
• Run on every PR + on push to main.

Prerequisite

• main currently has 3 preexistent clippy warnings; a separate small PR must clean them up before -D warnings becomes a gate (otherwise the first CI run on main rebounds).