myAudit v0.3.0

The frontend gets a real state architecture, and tickets get their git trail.

Added
- Tickets show the work behind a finding: the fix commit, the branch it is
  labelled with, and copy actions whose command follows where that branch
  actually lives — the run workspace before a push, your own clone after one.
- Chat is a first-class tab, replacing the floating dock. It can now see the
  findings board, not only the code and the audit notes.
- API responses and request bodies are validated against Zod schemas written
  from the Go structs.

Changed
- Frontend state moved to Zustand; polling is centralised and paused for
  screens you are not looking at.
- Routine dependency-bump PRs replaced by security-only updates, with CodeQL,
  actionlint, gosec, cargo audit and a Go coverage floor in CI.
- TypeScript strict enabled for the web app.

Fixed
- The ticket drawer no longer jumps while you read a finding: the desktop
  app's WebKit engine has no CSS scroll anchoring.
- Findings are classified bug / improvement / style / question, so a style
  note can no longer arrive as a P0.
- A stale index.html next to a newer build is ignored rather than served as a
  blank page that looked like a crash.

Security
- dompurify forced to 3.4.15, clearing four advisories in the sanitiser the
  rendered markdown goes through.
- vitest and @vitest/coverage-v8 updated to 5.x, clearing a path-traversal
  advisory in @vitest/mocker (dev tooling only).

See CHANGELOG.md for the full list.