ci: enforce oxlint/oxfmt in CI and a lefthook pre-commit hook

[i11v]

Follow-up to #20: actually enforce the linter and formatter, in CI and locally.

What

1. CI gates (ci: enforce lint and formatting checks)

• Adds bun run lint (oxlint) and bun run fmt:check (oxfmt) right after bun install in both workflows — deploy.yml (production) and pr-preview.yml (PRs).
• Placed before typecheck/test/build so the cheap static checks fail fast.

2. Pre-commit hook via Lefthook (build: add pre-commit hook via lefthook)

• Uses Lefthook (dev dependency) to manage git hooks — the modern, dependency-light husky alternative (single Go binary, declarative config, no Node at hook time).
• lefthook.yml declares a pre-commit hook that runs oxlint and oxfmt --check in parallel, mirroring the CI static checks. Bypass a run with git commit --no-verify.
• Hooks install automatically via lefthook install, run from the existing prepare script on bun install (guarded with || true so a non-git install context can't break prepare).

Verification

• Lefthook hook verified end-to-end: runs lint+format in parallel, passes on a clean tree and blocks an unformatted commit (exit 1). It ran live on both commits in this PR.
• lint, fmt:check, typecheck, test (79), build:web, verify:pwa all green; bun install --frozen-lockfile in sync.

Note

After pulling this, contributors get the hook automatically on their next bun install (via prepare) — no manual setup. To enable immediately without reinstalling: bunx lefthook install.

🤖 Generated with Claude Code

https://claude.ai/code/session_014DWovxbG4A7Ebda7xhG9nA

[github-actions]

🚀 Preview deployed: https://preview-21.tablo.run
_{fallback: https://tablo-pr-21.i11v.workers.dev}