TASK: Add a CI workflow for PHP, the inspector build and ESLint

[gradinarufelix]

Resolves #34

Adds .github/workflows/ci.yml. It runs on pull requests and pushes to main and needs no database. The workflow token can only read the repository, and no checkout keeps it.

Six checks run in seven jobs, because PHP lint runs for two PHP versions:

Check	What it does
PHP lint	php -l on Classes and Migrations with PHP 7.4 and 8.3.
PHPStan	Installs Neos 8 in a throwaway distribution with this package as a path repository (composer init, then composer require neosidekick/revisions:*@dev phpstan/phpstan:2.2.16). Then runs PHPStan with phpstan.neon: level 5 on Classes, plus phpstan-baseline.neon.
Composer manifest	composer validate --no-check-publish with PHP 8.3. Nothing is installed.
Translation files	xmllint --noout on every .xlf file under Resources/Private/Translations, which must be well-formed XML.
Inspector build reproducibility	Node from .nvmrc, which pins 14.21.3. Runs npm install --no-package-lock and node build.js in the plugin directory, then git diff --exit-code on Resources/Public/Assets/Plugin.js.
ESLint	npm install --no-package-lock at the root, then npm run lint with the existing configuration.

PHPStan is pinned to 2.2.16, the version that generated the baseline, so a new PHPStan release cannot change the findings. The Neos packages that PHPStan analyses against are not pinned yet (#38). The Readme describes how to run the checks locally, including how to regenerate the baseline.

What main needed to pass

ESLint. The existing configuration could not run at all: @typescript-eslint 4 requires typescript, which was not a dev dependency. This PR adds typescript ~4.4.4, the newest version that @typescript-eslint 4.33 supports. On main, ESLint then reported 32 errors. The first commit fixes them:

• 28 formatting findings, fixed with eslint --fix;
• comments in two intentionally empty catch blocks;
• rel="noreferrer" on the asset link that opens a new tab;
• Record<string, unknown> instead of {} as the default response type of fetchFromBackend().

Plugin.js is rebuilt. Apart from the rel attribute, only the layout of the bundled code changes.

PHPStan. Error counts on main before #35 (bd4af63), measured with PHPStan 2.2.16 and Neos 8.4.7:

Level	0	1	2	3	4	5	6	7	8	9
Errors	0	0	5	7	18	18	57	68	78	91

Level 5 checks argument types but not the missing type declarations that level 6 adds. The 18 findings at level 5 are in the baseline, so only new ones fail. They fall into three groups:

• docblocks that do not match the runtime types;
• calls to methods that Node has but NodeInterface does not declare;
• conditions PHPStan considers always true or always false.

The baseline was generated in CI. #35 adds no finding at level 5: the PHPStan job passes on the rebased branch with the unchanged baseline.

Runs

• Before this PR, on this branch with a temporary push trigger that this PR no longer contains: run 36308226663, green on the five jobs the workflow had then.
• The pull_request run of this PR is in the checks below.

Not in this PR

• TASK: Lock the CI toolchains (committed lockfiles, npm ci, pinned Neos versions for PHPStan) #38: committed lockfiles installed with npm ci, and pinned Neos versions for PHPStan. CI installs the npm packages without a lockfile, and the root yarn.lock predates the switch to esbuild and is not used. A new minor release of an ESLint plugin or a build dependency can therefore turn a job red without any change here.
• TASK: Fix the findings recorded in the PHPStan baseline #39: fixing the findings recorded in the PHPStan baseline.