Restore reproducible installs and add CI regression coverage

[llinsss]

Problem

A fresh checkout is not reproducible: npm ci fails because package-lock.json is out of sync with package.json (missing Hardhat Ignition and transitive packages). There is also no CI workflow, and the core frontend logic (questionEngine, tutor/store, timers, routing, persistence) has no automated tests, so regressions can merge unnoticed.

Current reproduction

npm ci
npm error `npm ci` can only install packages when package.json and package-lock.json are in sync
npm error Missing: @nomicfoundation/hardhat-ignition@0.15.16 from lock file
...

Proposed scope

• Regenerate and commit the lockfile with the supported Node/npm versions; document and pin those versions.
• Add GitHub Actions for clean install, lint, type-check/build, contract compile/tests, and frontend unit/component tests.
• Add deterministic tests for question invariants, adaptive thresholds, Zustand actions/migration, timer races, and route validation.
• Add Solidity coverage/security checks and cache dependencies safely.
• Keep deployment secrets out of pull-request workflows.

Acceptance criteria

• npm ci succeeds from a clean checkout on the documented runtime.
• CI runs on pull requests and protected-branch pushes and blocks merges on failures.
• npm run lint, npm run build, and npm run test:contracts pass in CI.
• Core frontend modules have meaningful regression tests; contract coverage includes reward and leaderboard edge cases.
• README contains one verified local-validation command sequence matching CI.

[vrickish]

Hi maintainer, I would like to work on this issue.

[vrickish]

Hi maintainer, I would like to work on this issue.

[grantfox-oss]

🦊 GrantFox — @vrickish has been assigned to this issue as part of the Third Campaign campaign!

Next steps:

1. Open a Pull Request referencing this issue (e.g., Closes #3)
2. Your PR will be reviewed by the DogStark maintainers

Good luck! Track your progress on GrantFox.