fix: security vulnerabilities and add CI/testing infrastructure

[johnwaldo]

Summary

This PR addresses all open security and quality issues:

Security Fixes

1. Security: Command injection risk in agent dispatch endpoint #18: Command injection risk in agent dispatch endpoint

   • Sanitize body.command to reject shell metacharacters (;&|\$(){}[]<>!#*?"'`)
   • Validate workDir against allowed directories (aidevopsDir, workspaceDir, gitDir, etc.)
   • Add maximum command length (2000 chars)

2. Security: Localhost auth bypass via X-Forwarded-For spoofing #19: Localhost auth bypass via X-Forwarded-For spoofing

   • Add DASHBOARD_TRUST_PROXY config (default: false)
   • Only trust proxy headers (X-Forwarded-For, X-Real-IP) when explicitly enabled
   • This prevents remote attackers from spoofing 127.0.0.1 to bypass auth

3. Security: CORS allows all origins (no production restriction) #20: CORS allows all origins in production

   • Add NODE_ENV / DASHBOARD_ENV detection
   • Restrict CORS to known origins in production
   • Add DASHBOARD_ALLOWED_ORIGINS config for whitelisting

Quality Improvements

4. Add CI pipeline (lint, typecheck, build) #22: Add CI pipeline

   • Add GitHub Actions workflow (.github/workflows/ci.yml)
   • Runs: ESLint, TypeScript typecheck, Build
   • Add typecheck script to client

5. Add test suite — zero test coverage currently #21: Add test suite

   • Add bun:test for server-side tests
   • Add security.test.ts with validation tests
   • Fix TypeScript errors in client components

Testing

• ✅ Build passes (bun run build)
• ✅ Typecheck passes (bun run typecheck)
• ✅ Tests pass (bun test)
• ✅ Lint has warnings but no blocking errors

Breaking Changes

• DASHBOARD_TRUST_PROXY now defaults to false — ensure your setup works correctly
• CORS more restrictive in production — add allowed origins via DASHBOARD_ALLOWED_ORIGINS