Add CI workflow for syntax, Python compile, audit, and smoke checks

[toads]

Goal

Add a GitHub Actions workflow that runs the minimum validation suite for every push and pull request.

Scope

• Run node --check for the server and browser entrypoints
• Run python3 -m py_compile shared/sync_download.py
• Run npm audit --registry=https://registry.npmjs.org
• Add a small smoke test path for booting the server and checking a basic endpoint

Done when

• A failing syntax or audit check blocks CI
• The workflow is documented in the repository