Run the tests in CI before deploying, like BioSpex

[rbruhn]

Closes #88.

Brings CI in line with BioSpex (AustinMastLab/Biospex#524, AustinMastLab/Biospex#531): the tests run on pull requests and before every deploy, and production and development share one deploy workflow.

tests.yml (new): runs on pull requests into main and development, and is called by deploy.yml.

• test: PHP 8.5, Composer download cache, creates storage/framework (not in git), generates an APP_KEY for the run, Pint on the changed files (pull requests only), then vendor/bin/pest --compact. SQLite in memory comes from phpunit.xml.
• audit: composer audit --locked, pull requests only. It reports but never blocks a deploy.

phpunit.xml: the tests no longer depend on services the CI runner doesn't have:

• RESPONSE_CACHE_ENABLED=false and RESPONSE_CACHE_DRIVER=array. The response cache defaults to the Redis store, so the first CI run failed with Connection refused.
• MAIL_MAILER=array instead of smtp. Registration sends a verification email, which needed a mail server on 127.0.0.1:1025.

Locally they passed only because Redis and a mail catcher are running.

tests/TestCase.php: calls withoutMix(). CI runs the tests before assets are built, and without it 21 tests failed in a clean checkout on "Mix manifest not found" (pages returned 500, which also failed the login, registration and password-reset tests). With it, a fresh clone passes the same 48 tests (2 skipped) as a local checkout.

deploy-environment.yml (new): the build-and-deploy job, once, with an environment input. Same steps as before (IP allow-list and revoke, PHP, Composer, Yarn and npm run production, package, artifact, Deployer), except:

• Composer caches its downloads instead of vendor/.
• SSH trusts only .github/known_hosts, with StrictHostKeyChecking yes, instead of ssh-keyscan at deploy time. The file has both servers' ed25519, ECDSA and RSA keys; I checked them against the live servers.

deploy.yml:

• A tests job that both deploys need. [skip deploy] / [no deploy] skip it too.
• concurrency per branch, never cancelling a deploy in progress.
• The version is taken from the highest semver tag reachable from HEAD.
• Releases use gh release create --generate-notes from the previous release, so the notes list the merged pull requests instead of the merge commit message.

dependabot.yml (new): weekly pull requests into development for GitHub Actions (one grouped PR), Composer and npm (minor and patch grouped, at most 5 open each).

README: describes the tests, the shared workflow, the known-hosts file and Dependabot.

After merging:

• The production deploy from this merge runs the tests first and deploys.
• Run Build and Deploy manually on development after fast-forwarding it: tests, then a deploy with host-key checking on.
• Add the test check as required in the main ruleset.