chore: BehaviorGraph portfolio quality pass

.env.example

@@ -1,15 +1,12 @@
 # BehaviorGraph — environment template
 # Copy to .env and fill values. Never commit real secrets.
 
-# Backend
 BEHAVIORGRAPH_ENV=development
-DUCKDB_PATH=./data/uploads/behavior.duckdb
+
+# Optional: only needed if you wire a remote API later
 SUPABASE_URL=
 SUPABASE_ANON_KEY=
-SUPABASE_SERVICE_ROLE_KEY=
 
 # Frontend (Next.js)
-NEXT_PUBLIC_API_BASE=http://127.0.0.1:8000
-
-# Optional
-GITHUB_TOKEN=
+# Leave empty to use the embedded synthetic snapshot (static lab mode).
+NEXT_PUBLIC_API_URL=http://127.0.0.1:8000

.github/workflows/ci.yml

@@ -0,0 +1,53 @@
+name: CI
+
+on:
+  push:
+    branches: [main, "chore/**"]
+  pull_request:
+
+jobs:
+  api:
+    name: API (pytest + ruff)
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: apps/api
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+          cache: pip
+          cache-dependency-path: apps/api/requirements.txt
+      - name: Install
+        run: |
+          python -m pip install --upgrade pip
+          pip install -r requirements.txt
+      - name: Ruff
+        run: ruff check app tests
+      - name: Pytest
+        run: pytest -q
+
+  web:
+    name: Web (lint + typecheck + build)
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: apps/web
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: "20"
+          cache: npm
+          cache-dependency-path: apps/web/package-lock.json
+      - name: Install
+        run: npm ci
+      - name: Lint
+        run: npm run lint
+      - name: Typecheck
+        run: npm run typecheck
+      - name: Build
+        run: npm run build
+        env:
+          GITHUB_PAGES: "false"

.gitignore

@@ -49,3 +49,5 @@ Thumbs.db
 *.duckdb.wal
 .gh-pages-tmp/
 BehaviorGraph-gh-pages/
+apps/api/.venv/
+apps/web/out/