feat(ui): three-page console SPA on @unom/ui + the kit's react helpers

Overview (exporter health, Playnite version, counts, sync, live SSE activity,
and a first-run panel that names the exact ingest path the .pext writes to),
Library (covers + per-game include toggles + why-not-synced), Settings
(filters, art delivery, sync cadence, paths).

Data layer is AtomHttpApi atoms derived from the shared contract; the whole
thing runs with zero host against an in-browser mock transport with four
scenarios, and Storybook renders the real pages on the same fixtures. CI now
asserts the production bundle carries no fixture strings.

Also: CI rebuilt for the workspace layout (one root install, per-package
typecheck, publish from plugin/ on a v* tag) with the exporter job and
`publish: needs [build, exporter]` unchanged; README rewritten around the three
workspaces, with the ingest inbox explained as the load-bearing mechanism it is.

.gitea/workflows/ci.yml

@@ -1,10 +1,11 @@
-# CI for @punktfunk/plugin-playnite (Gitea Actions).
-#   build    — the TS plugin + SPA: lint, typecheck, test, bundle (mirrors the rom-manager plugin CI).
-#   exporter — the C# Playnite extension → a `.pext`, built net462 with the .NET SDK on Linux (no
-#              Windows/MSBuild needed) and uploaded as a workflow artifact.
-#   publish  — npm publish to the Gitea registry on a `v*` tag.
-# Installs resolve @punktfunk/* from the Gitea registry via the bunfig scope map + REGISTRY_TOKEN;
-# everything else (effect, react, tailwind…) comes from npm.
+# CI for the playnite workspace (Gitea Actions).
+#   build    — the three bun workspaces (contract + plugin + ui): one root install, lint,
+#              per-package typecheck, domain tests, bundle + SPA. Mirrors rom-manager's.
+#   exporter — the C# Playnite extension → a `.pext`, built net462 with the .NET SDK on
+#              Linux (no Windows/MSBuild needed) and uploaded as a workflow artifact.
+#   publish  — npm publish to the Gitea registry on a `v*` tag, from plugin/.
+# @punktfunk/* and @unom/* resolve from the Gitea registry via the root bunfig scope maps
+# + REGISTRY_TOKEN; everything else (effect, react, tailwind…) comes from npm.
 name: CI
 
 on:
@@ -31,22 +32,38 @@ jobs:
         run: |
           test -n "$TOKEN" || { echo "REGISTRY_TOKEN secret is empty"; exit 1; }
           printf '//git.unom.io/api/packages/unom/npm/:_authToken=%s\n' "$TOKEN" > "$HOME/.npmrc"
-      - name: Install
+      - name: Install (workspace)
         run: bun install --frozen-lockfile
       - name: Lint & format
         run: bunx biome check
-      - name: Typecheck (backend)
+      - name: Typecheck (contract)
+        working-directory: contract
         run: bunx tsc --noEmit
-      - name: Test (engine)
+      - name: Typecheck (plugin)
+        working-directory: plugin
+        run: bunx tsc --noEmit
+      - name: Test (domain)
+        working-directory: plugin
         run: bun test
-      - name: Build backend + SPA
+      - name: Build backend bundle + SPA
+        working-directory: plugin
         run: bun run build:all
       - name: Typecheck (UI)
         working-directory: ui
         run: bunx tsc --noEmit
       - name: Sanity — plugin default export is a valid PluginDef
+        working-directory: plugin
         run: |
-          bun -e 'import p from "./dist/index.js"; const d = p.default ?? p; if (d?.name !== "playnite" || typeof d?.main !== "function") { console.error("bad default export", d); process.exit(1); } console.log("ok:", d.name)'
+          bun -e 'import plugin from "./dist/index.js"; if (plugin?.name !== "playnite" || typeof plugin?.main !== "function") { console.error("bad default export", plugin); process.exit(1); } console.log("ok:", plugin.name)'
+      - name: Sanity — no fixtures in the production SPA bundle
+        working-directory: plugin
+        run: |
+          for needle in placehold.co mockHttpClientLayer tickerFrames; do
+            if grep -rq "$needle" dist/ui/assets/*.js; then
+              echo "fixture string '$needle' leaked into the production bundle"; exit 1
+            fi
+          done
+          echo "ok: production bundle is fixture-free"
 
   exporter:
     runs-on: ubuntu-24.04
@@ -90,12 +107,14 @@ jobs:
         run: |
           test -n "$TOKEN" || { echo "REGISTRY_TOKEN secret is empty"; exit 1; }
           printf '//git.unom.io/api/packages/unom/npm/:_authToken=%s\n' "$TOKEN" > "$HOME/.npmrc"
-      - name: Install
+      - name: Install (workspace)
         run: bun install --frozen-lockfile
       - name: Tag matches package version
+        working-directory: plugin
         run: |
           TAG="${GITHUB_REF_NAME#v}"
           PKG="$(node -p "require('./package.json').version")"
           test "$TAG" = "$PKG" || { echo "tag $GITHUB_REF_NAME != package version $PKG"; exit 1; }
       - name: Publish (prepublishOnly builds backend + SPA)
+        working-directory: plugin
         run: bun publish