[MekDrop]

Summary

• Add worker/wrangler.toml with name, main, compatibility_date, and [vars] for SPA_URL, GH_RUNNER_OWNER, and GH_RUNNER_REPO
• Add worker/.dev.vars.example documenting required secrets for local development
• Add worker/src/index.js — minimal itty-router entry point with a GET / health route returning { status: 'ok' }
• Add worker/.eslintrc.cjs with eslint:recommended and ES module source type
• Wire itty-router and tweetnacl as runtime deps; wrangler and eslint as devDeps in worker/package.json
• Add frontend/src/services/gitlab.js with GitLab PKCE OAuth flow helpers (startGitlabLogin, exchangeGitlabCode)

Closes #5
Closes #7

Test plan

• npm install completes without errors
• npm -w worker run build (wrangler deploy --dry-run) succeeds
• npm -w worker run lint passes with no errors
• Trigger startGitlabLogin('gitlab.com', clientId) and verify redirect URL contains correct code_challenge, code_challenge_method=S256, response_type=code, scope=read_api, and redirect_uri
• Verify sessionStorage keys gitlab_verifier and gitlab_host are set before redirect
• After redirect back with ?code=..., call exchangeGitlabCode(code) and confirm it POSTs to https://gitlab.com/oauth/token with the correct body fields
• Confirm sessionStorage keys are removed after exchangeGitlabCode is called

[MekDrop]

Superseded by separate PRs: #26 (worker scaffold, closes #5) and #27 (GitLab PKCE, closes #7).