ci: add GitHub Actions workflow — typecheck, tests, build

Three jobs on push/PR to main:
- typecheck: tsc --noEmit on api, whatsapp-worker, admin (after Prisma generate + ai-sdk build)
- test: vitest run (excluding AI regression) against real Postgres/pgvector + Redis service containers,
runs migrate:deploy before tests
- build: pnpm turbo run build gated on typecheck passing

Concurrency group cancels in-progress runs on new push to same branch.
AI regression tests (test/regression/) excluded — require real API keys, run manually.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

.github/workflows/ci.yml

@@ -0,0 +1,138 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+concurrency:
+  group: ci-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  # ─── TypeScript ───────────────────────────────────────────────────────────────
+  typecheck:
+    name: TypeScript
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: pnpm/action-setup@v4
+        with:
+          version: 9.15.0
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+          cache: pnpm
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Generate Prisma client
+        run: pnpm --filter @repo/database generate
+
+      - name: Build ai-sdk (needed for downstream tsc)
+        run: pnpm --filter @repo/ai-sdk build
+
+      - name: tsc — api
+        run: pnpm --filter api exec tsc --noEmit
+
+      - name: tsc — whatsapp-worker
+        run: pnpm --filter whatsapp-worker exec tsc --noEmit
+
+      - name: tsc — admin
+        run: pnpm --filter admin exec tsc --noEmit
+
+  # ─── Unit & Integration Tests ────────────────────────────────────────────────
+  test:
+    name: Tests
+    runs-on: ubuntu-latest
+
+    services:
+      postgres:
+        image: ankane/pgvector:latest
+        env:
+          POSTGRES_USER: postgres
+          POSTGRES_PASSWORD: postgres
+          POSTGRES_DB: edtech_test
+        ports:
+          - 5432:5432
+        options: >-
+          --health-cmd pg_isready
+          --health-interval 10s
+          --health-timeout 5s
+          --health-retries 5
+
+      redis:
+        image: redis:7-alpine
+        ports:
+          - 6379:6379
+        options: >-
+          --health-cmd "redis-cli ping"
+          --health-interval 10s
+          --health-timeout 5s
+          --health-retries 5
+
+    env:
+      DATABASE_URL: postgresql://postgres:postgres@localhost:5432/edtech_test
+      REDIS_URL: redis://localhost:6379/1
+      ADMIN_API_KEY: test-api-key-32-chars-long-at-least-123456
+      ENCRYPTION_SECRET: test-encryption-secret-32-chars-long-123456
+      JWT_SECRET: test-jwt-secret
+      NODE_ENV: test
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: pnpm/action-setup@v4
+        with:
+          version: 9.15.0
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+          cache: pnpm
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Generate Prisma client
+        run: pnpm --filter @repo/database generate
+
+      - name: Build ai-sdk
+        run: pnpm --filter @repo/ai-sdk build
+
+      - name: Run database migrations
+        run: pnpm --filter @repo/database migrate:deploy
+
+      - name: Run unit & integration tests
+        # Exclude AI regression tests — they require real API keys and are slow
+        run: pnpm --filter api exec vitest run --exclude 'test/regression/**'
+
+  # ─── Build ───────────────────────────────────────────────────────────────────
+  build:
+    name: Build
+    runs-on: ubuntu-latest
+    needs: [typecheck]
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: pnpm/action-setup@v4
+        with:
+          version: 9.15.0
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+          cache: pnpm
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Generate Prisma client
+        run: pnpm --filter @repo/database generate
+
+      - name: Build all packages and apps
+        run: pnpm turbo run build