ci(contracts): run API spec, route parity, module graph, and i18n parity gates #685

Parent epic: #679

Evidence

.github/workflows/ci.yml does not run all repository checks represented by bun run check; notably API spec checks and E2E coverage are not consistently enforced. The audit also found missing gates for module DAG/source boundaries and gettext catalog parity.

Objective

Make pull requests fail when code, contracts, translations, or registered module boundaries drift.

Scope

• Run api:spec:check explicitly in CI.
• Add route-method-operation-security parity checks for OpenAPI.
• Add AsyncAPI validation where event contracts change.
• Add module DAG and forbidden-cross-import gates.
• Add EN/ID/POT key parity gate.
• Add a focused E2E smoke lane against PostgreSQL.
• Use dependency caching without weakening frozen-lockfile behavior.
• Upload concise test artifacts on failure; redact secrets.

Acceptance criteria

• Each gate is visible as a distinct CI step/check.
• Tests include intentional fixtures proving each drift type fails.
• E2E provisions an isolated database and cleans it safely.
• Branch protection documentation identifies required checks.
• CI uses pinned action versions and least-required permissions.
• bun run check and CI orchestration share the same source-of-truth commands.