feat: add TypeBox/Ajv config schema package to the workspace (E00-S04-T01)

Adds packages/config (@personal-blog/config) — the EPPP configuration
service foundation. The package defines the configuration schema with
TypeBox (configSchema: host, port, databaseUrl, sessionSecret — the
validated config fields, golden-tuple pins @sinclair/typebox@0.34.52 and
ajv@8.20.0) and compiles it with Ajv (validateConfig). The environment
adapter (T04), field-specific startup errors (T02) and secret redaction
(T03) build on this boundary in later tasks; nothing reads process.env yet.

Wiring for the new workspace package: lockfile importer + resolved
typebox/ajv tree, apps/server/Dockerfile manifest copy (frozen in-image
install must match the lockfile importers), config-schema CI job, package
set fixtures (workspace-layout, workspace-config, strict-tsconfig,
typescript-pin), probe-file gitignore entry.

.gitea/workflows/ci.yml

@@ -167,6 +167,33 @@ jobs:
       - name: Run app readiness test suite
         run: node --test tests/app-readiness.test.mjs
 
+  # E00-S04-T01: the static assertions of tests/config-schema.test.mjs gate
+  # every PR — the suite locks in the TypeBox/Ajv configuration schema
+  # (packages/config, golden-tuple pins @sinclair/typebox@0.34.52 +
+  # ajv@8.20.0) with mutation probes, and the deterministic probe executes
+  # the issue's test plan ("validate a full config against the TypeBox/Ajv
+  # schema") against the committed schema through Ajv. The job installs the
+  # frozen workspace and builds the config package because the probe also
+  # exercises the compiled package boundary (@personal-blog/config) exactly
+  # as the later configuration adapter will consume it.
+  config-schema:
+    name: TypeBox/Ajv config schema (E00-S04-T01)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Install Node.js 24
+        uses: actions/setup-node@v4
+        with:
+          node-version: '24'
+      - name: Enable pnpm (corepack, pinned to 11.23.0 via packageManager)
+        run: corepack enable
+      - name: Install dependencies (frozen lockfile)
+        run: pnpm install --frozen-lockfile
+      - name: Build the config package (the probe exercises the compiled package boundary)
+        run: pnpm --filter @personal-blog/config build
+      - name: Run config schema test suite
+        run: node --test tests/config-schema.test.mjs
+
   # E00-S03-T01: the static assertions of tests/compose-config.test.mjs (db
   # image pinned to postgres:18.6-bookworm, health gate, volume persistence,
   # build platforms) gate every PR (the docker-gated real-stack probes inside