Add baseline CI/CD: typecheck, lint, and Docker image publish

[WiderDeveloper]

Summary

Addresses the CI/CD audit finding (0 GitHub Actions workflows, no test config) tracked internally as WID-196, part of the WID-122 repo audit.

• .github/workflows/ci.yml — runs on every push/PR to main:
  • TypeScript typecheck (tsc --noEmit, via npm test)
  • ruff lint on nlp-service/
• .github/workflows/docker-publish.yml — on push to main, builds and pushes server and nlp-service Docker images to GHCR (ghcr.io/wider-community/resolve-ai/...). No new secrets required — uses the built-in GITHUB_TOKEN.
• Dockerfile (root, Node/Express via tsx) and nlp-service/Dockerfile (Python/FastAPI) — both verified building successfully locally.
• Fixed 4 pre-existing unused-import lint violations in nlp-service/ (main.py, test_service.py) surfaced by adding ruff — mechanical, no behavior change — so CI is green from the first run.

Scope notes / known gaps

• server.ts is not covered by the TypeScript typecheck. tsconfig.json only includes src/**/*, and server.ts (the app entrypoint) has 2 pre-existing type errors (AgentContext missing sentiment/sentimentScore/etc. fields) that are outside the scope of a CI/CD baseline change. Filed as a follow-up.
• No real automated test suite exists. nlp-service/test_service.py is a manual smoke script (loads a spaCy model, calls Gemini) rather than an assertion-based test, so it isn't wired into CI. Typecheck + lint are the "test" baseline for now.
• No deployment target is configured (no existing Dockerfile/infra config was in the repo, no hosting docs). This PR adds image build & publish (CI/CD artifact pipeline) but not a deploy-to-environment step, since that requires an infra decision (host, secrets) outside this repo's current setup. Recommend a follow-up once a target is chosen.
• Branch protection on main could not be configured via the API — the org is on the GitHub Free plan, which does not support branch protection rules (or rulesets) on private repos (403: Upgrade to GitHub Pro or make this repository public). This needs a plan upgrade or a visibility change, decided by org ownership.
• The GHCR push job requests permissions: packages: write at the job level, which should work even though the repo's default workflow token permission is read-only. If the push step fails with a permissions error, enable "Read and write permissions" under Settings → Actions → General → Workflow permissions.

Test plan

• npm ci && npx tsc --noEmit passes cleanly on src/**
• ruff check nlp-service passes cleanly after the import fixes
• docker build -t resolve-ai-server:test . succeeds locally
• docker build -t resolve-ai-nlp:test nlp-service succeeds locally
• First CI run on this PR (GitHub Actions) — verify green