ci: add github actions pipeline and vercel deployment

- go build, vet, unit/integration/e2e tests, and web build on push and pr
- vercel auto-deploy of the web ui, production on main and preview on prs
- requires VERCEL_TOKEN, VERCEL_ORG_ID, VERCEL_PROJECT_ID secrets

.github/workflows/ci.yml

@@ -0,0 +1,54 @@
+name: ci
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+jobs:
+  go:
+    name: build and test
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-go@v5
+        with:
+          go-version: "1.26.x"
+          cache: true
+
+      - name: Build
+        run: go build ./...
+
+      - name: Vet
+        run: go vet ./...
+
+      - name: Unit tests
+        run: go test ./...
+
+      - name: Integration tests (fake apiserver)
+        run: go test -tags integration ./test/integration/...
+
+      - name: End-to-end tests
+        run: go test -tags e2e ./test/e2e/...
+
+  web:
+    name: build web ui
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: "22"
+
+      - name: Install
+        working-directory: web
+        run: npm ci
+
+      - name: Build
+        working-directory: web
+        run: npm run build
+
+      - name: Verify dist
+        run: test -d web/dist && test -f web/dist/index.html

.github/workflows/vercel.yml

@@ -0,0 +1,26 @@
+name: vercel
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+jobs:
+  deploy:
+    name: deploy web ui
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      # Requires repository secrets:
+      #   VERCEL_TOKEN       personal access token (vercel.com/account/tokens)
+      #   VERCEL_ORG_ID      org id (vercel.com -> account settings)
+      #   VERCEL_PROJECT_ID  project id (vercel.com -> project settings)
+      - name: Deploy to Vercel
+        uses: amondnet/vercel-action@v20
+        with:
+          vercel-token: ${{ secrets.VERCEL_TOKEN }}
+          vercel-org-id: ${{ secrets.VERCEL_ORG_ID }}
+          vercel-project-id: ${{ secrets.VERCEL_PROJECT_ID }}
+          working-directory: ./web
+          vercel-args: ${{ github.ref == 'refs/heads/main' && '--prod' || '--preview' }}