ci: run biome lint on pull requests and main

[Bilb]

Adds the repo's first GitHub Actions workflow: runs pnpm run lint (biome) on every pull request and on pushes to main.

• Node version comes from .nvmrc, pnpm version from the packageManager field in package.json, so neither is duplicated here.
• Checks out submodules recursively, since biome lints the .ts files in lib/app_localization.
• pnpm install --frozen-lockfile, with pnpm store caching.

Heads up: this check is red on main today

pnpm lint currently reports 12 errors on main as-is, so the job will fail on this PR too. Nothing in the workflow suppresses that — the point is to surface it. Current failures:

count	rule	where
9	a11y/noSvgWithoutTitle	8 files in components/copied/, plus pages/pro.tsx:32
1	a11y/useValidAnchor	pages/pro.tsx:721
1	security/noDangerouslySetInnerHtml	pages/donate.tsx:111 (DonorBox embed)
1	correctness/noUnreachable	lib/proBackend.ts:28 (dead fetch after an early return)

These need judgement rather than a blanket autofix — the icons are decorative and want aria-hidden, not a <title>; the DonorBox embed warrants a scoped biome-ignore with a reason. Left for a follow-up so this PR stays reviewable.

Separately, biome.json's files.includes has no exclusion for build output, so local runs also lint .next/types/* and produce ~40 warnings from generated files. Not fixed here.