ci: add CI pipeline with analysis, tests, security audit, and debug build

Add ci.yaml triggered on branch pushes and PRs with flutter analyze,
flutter test, dart pub audit, Trivy scan, and debug APK build. Gate the
release workflow behind a CI job so release builds only proceed after
all checks pass.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

CHANGELOG.md

@@ -2,6 +2,12 @@
 
 All notable changes to HouseHoldKeeper are documented in this file.
 
+## [1.1.4] - Unreleased
+
+### Added
+- CI workflow for branch pushes and pull requests with static analysis, tests, security audit, and debug build
+- Security gate in release workflow — CI checks must pass before release build proceeds
+
 ## [1.1.3] - 2026-03-17
 
 ### Added