feat(platform): I1 bootstrap, I2 M1 APIs, OpenAPI SSOT, and CI guards

Deliver dual Spring Boot services (platform API + webhook ingress), JWT
auth, Flyway with isolated history tables, customer/project/dictionary
endpoints, OpenAPI snapshot under contracts/, RUNBOOK, and CI that runs
on services/web/contracts paths plus enforcer + dependency tree ban on
craftlabs-auth-bitanswer.

Made-with: Cursor

.github/workflows/ci-platform.yml

@@ -0,0 +1,52 @@
+name: ci-platform
+
+on:
+  push:
+    branches: [main, master]
+    paths:
+      - "services/**"
+      - "web/**"
+      - "contracts/**"
+      - ".github/workflows/ci-platform.yml"
+  pull_request:
+    branches: [main, master]
+    paths:
+      - "services/**"
+      - "web/**"
+      - "contracts/**"
+      - ".github/workflows/ci-platform.yml"
+
+jobs:
+  maven-services:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-java@v4
+        with:
+          distribution: temurin
+          java-version: "17"
+          cache: maven
+      - name: Forbid craftlabs-auth-bitanswer in platform tree
+        run: |
+          set -euo pipefail
+          TREE=$(mvn -f services/pom.xml -q -DskipTests dependency:tree -pl delivery-platform-api,license-webhook-ingress -am)
+          if echo "$TREE" | grep -q 'craftlabs-auth-bitanswer'; then
+            echo "::error::Banned dependency craftlabs-auth-bitanswer found in platform dependency tree"
+            echo "$TREE"
+            exit 1
+          fi
+      - name: Maven verify (platform services)
+        run: mvn -f services/pom.xml -B verify
+
+  web-ui-build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: "20"
+      - name: npm install and build
+        working-directory: web/delivery-platform-ui
+        run: |
+          npm install
+          npm run build