ci: Add typecheck and build workflow for consumer UI

[ecv]

Summary

A dependency upgrade to the consumer UI plugin lands today with no signal on whether it broke the app, since nothing runs on push or on a pull request.

That already blocks a pending router security fix, because only a build reveals whether the new version breaks routing.

This adds a workflow that installs the app's dependencies, type-checks it, and builds it on every push and pull request, so an upgrade proves itself before merge.

A frozen install needs a lockfile to freeze against, and the app never had one committed, so this change adds that too.

Details

• Triggers on push and on pull request against main, using Bun since that is what the app's build and lockfile already commit to, with Node set from the version already pinned in the repo.
• The pinned Node version is well above the highest requirement among the app's dependencies, so no version bump was needed.
• The app's Docker build doesn't pin a Node version at all, since it builds and runs on Bun images directly, so there's no mismatch to reconcile there.
• Verified locally that install, type check and build all pass against the newly committed lockfile. They also pass with the pending react-router security update applied, which confirms that upgrade is safe to merge.

Test plan

• CI runs on this PR and passes for the current dependencies
• The pending router security update also passes once rebased on this workflow

Related to #4

https://claude.ai/code/session_01T2Bmcs7qWPaw1R6HnmrmBq

[kevwilliams]

Adds a straightforward CI workflow (checkout, setup-node from .nvmrc, setup-bun, frozen-lockfile install, typecheck, build) scoped to ui/consumer, plus the missing bun.lock it depends on. Triggers and working directory are correct, scripts match package.json, no secrets or elevated permissions are involved, and there's no pull_request_target or injected untrusted input. Low risk, closes a real CI gap.