ci: engines >=20 + .nvmrc; hard audit gate; boot check; bundle budget; eslint ratchet

- engines.node >=20.0.0 and .nvmrc mirroring .node-version (#54)
- npm audit --audit-level=high is a hard gate (tree is at 0) (#91)
- scripts/boot-check.mjs serves dist/ with vite preview and asserts /,
  config.json, the entry chunk and the Element Call bundle all load (#92)
- scripts/check-bundle-size.mjs enforces gzip budgets from
  scripts/bundle-budget.json (seeded +10%); fails PRs, warns on push (#96)
- check:eslint runs with --max-warnings 68 so the count can only go down;
  7 unused eslint-disable directives removed to get there (#97)

Fixes #54
Fixes #91
Fixes #92
Fixes #96
Fixes #97

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PPmy3tPq869XDW4njjVaKA

scripts/bundle-budget.json

@@ -0,0 +1,5 @@
+{
+  "$comment": "Gitea #96. Budgets are seeded from the dist/assets gzip sizes on the tree at seed time, +10% headroom. Regenerate deliberately (not just to silence a failure) when a real feature addition grows the bundle: measure the new gzip sizes and bump these with the same +10% margin.",
+  "totalGzipBytes": 1731120,
+  "largestChunkGzipBytes": 358317
+}