Fix CI/CD: npm workspaces lockfile, missing ESLint configs, Docker credential handling

[Copilot]

All 4 failing CI checks stemmed from the repo being an npm workspaces project but the workflows expecting per-subdirectory package-lock.json files (which don't exist), plus zero ESLint configuration anywhere. The Deploy job crashed immediately on Docker login when Hub secrets weren't configured.

CI workflow (ci.yml)

• Removed defaults.run.working-directory from each job; replaced with explicit working-directory: per step
• Changed cache-dependency-path from backend/package-lock.json etc. → root package-lock.json
• npm ci now runs from repo root (resolves the workspace lockfile); lint/typecheck/test steps still run from their workspace directory

ESLint configs (all new)

• backend/.eslintrc.json / cli/.eslintrc.json — @typescript-eslint/recommended without typed linting (avoids tsconfig path resolution issues across src + tests)
• frontend/.eslintrc.json — next/core-web-vitals only (@typescript-eslint plugin is not in frontend deps)

Deploy workflow (deploy.yml)

• publish-cli: same workspace-install fix as CI (root npm ci, explicit working-directory: cli per step)
• push-docker-images: removed invalid job-level secrets.* condition (GitHub Actions doesn't allow secrets context in job if); replaced with a step-level credential pre-check that emits a warning and skips push steps when DOCKER_USERNAME/DOCKER_TOKEN are absent:

- name: Check Docker credentials
  id: creds
  run: |
    if [ -n "$DOCKER_USERNAME" ] && [ -n "$DOCKER_TOKEN" ]; then
      echo "available=true" >> "$GITHUB_OUTPUT"
    else
      echo "available=false" >> "$GITHUB_OUTPUT"
      echo "::warning::DOCKER_USERNAME or DOCKER_TOKEN secret is not set — skipping image push."
    fi
  env:
    DOCKER_USERNAME: ${{ secrets.DOCKER_USERNAME }}
    DOCKER_TOKEN: ${{ secrets.DOCKER_TOKEN }}

Minor fixes

• mev-detector.ts: removed unused PublicKey import; exported DEX_PROGRAMS (was assigned but never used — lint error)
• frontend/public/.gitkeep: Dockerfile.frontend unconditionally COPYs this directory; it must exist

---

🔒 GitHub Advanced Security automatically protects Copilot coding agent pull requests. You can protect all pull requests by enabling Advanced Security for your repositories. Learn more about Advanced Security.