ci: consolidate web and android workflows into one pipeline

Both subprojects ship from the same commit, so ordinary CI is now a single
ci.yml; only the tag-driven release stands apart. The web app is built twice
per run — once per base path — and every consumer downloads the artifact
instead of rebuilding, replacing three redundant base-"" builds on main.

Nothing deploys unless the test job is green, and android-release runs the
suite before signing (ci.yml does not fire on tags, so it was the only gap).

Shared toolchain setup moves into composite actions, which puts the web build
and the APK on the same Node version for the first time. The Firebase PR path
was still on npm ci against a stale web/package-lock.json that could resolve a
different tree than pnpm-lock.yaml; drop the lockfile and the npm path with it.

Also: least-privilege permissions widened per job, persist-credentials off on
every checkout, concurrency groups that cancel superseded PRs but never a live
deploy, npm caching for android, and the Firebase action pinned by commit SHA
to match how the release actions were already pinned.

web/docs/codebase-summary.md

@@ -50,8 +50,8 @@
 | `svelte.config.js` | adapter-static (HTML export), dual basePath via BUILD_PROFILE env, SvelteKit PWA plugin config. |
 | `vite.config.js` | Tailwind + SvelteKit + PWA plugins. codeserver HMR config (port, allowedHosts, hmr). |
 | `package.json` | SvelteKit 2, Svelte 5 (runes), Tailwind 4, Vite, @vite-pwa/sveltekit. Scripts: dev, dev:codeserver, build, build:gh, lint, test, test:watch. |
-| `.github/workflows/web-deploy-github-pages.yml` | Canonical deploy. On push to `main`: `npm ci && npm run build:gh`, uploads `build/` as the GitHub Pages artifact, deploys to `https://tiennm99.github.io/loto/`. |
-| `.github/workflows/web-verify-build.yml` | CI: on push/PR to main runs `npm test && npm run build` as a regression gate before the deploy job. |
+| `.github/workflows/ci.yml` | Repo-root pipeline for push/PR. `test` (`pnpm test`) gates a two-profile `build` matrix; the artifacts feed `deploy-pages` (canonical, `https://tiennm99.github.io/loto/`), `deploy-firebase`, `preview-firebase`, and `android-debug`. |
+| `.github/actions/setup-web/` | Composite action: pnpm + Node 24 + `pnpm install --frozen-lockfile` in `web/`. Shared by `ci.yml` and `android-release.yml`. |
 | `eslint.config.mjs` | ESLint 9 flat config (@eslint/js + eslint-plugin-svelte). Declares Svelte 5 rune globals. |
 | `jsconfig.json` | Path alias `$lib`, no checkJs. |
 | `.gitignore` | Excludes node_modules, build, .env.local, etc. |

web/docs/deployment-guide.md

@@ -15,9 +15,10 @@ either profile without code changes.
 
 ## Production Deployment — GitHub Pages
 
-Canonical deploy. Wired via `.github/workflows/web-deploy-github-pages.yml`:
-on push to `main`, runs `npm run build:gh`, uploads `build/` as the
-GitHub Pages artifact, and deploys.
+Canonical deploy. Wired via the `deploy-pages` job in
+`.github/workflows/ci.yml`: on push to `main`, the `build (gh)` job runs
+`pnpm build:gh` and uploads `build/`; `deploy-pages` downloads that artifact
+and publishes it. Both are gated on the `test` job.
 
 One-time setup (already done; documented for restoration):
 1. Repo → Settings → Pages → Source: **GitHub Actions**.
@@ -134,12 +135,21 @@ Generates:
 
 ## CI/CD Pipeline
 
-Two workflows on `main`:
-- **`.github/workflows/web-deploy-github-pages.yml`** — canonical deploy. Builds
-  with `npm run build:gh` and publishes `build/` to GitHub Pages.
-- **`.github/workflows/web-verify-build.yml`** — PR + push gate. Runs
-  `npm test && npm run build` to catch regressions before they reach the
-  deploy job.
+One workflow, `.github/workflows/ci.yml`, covers PRs and pushes to `main`:
+
+- **`test`** — `pnpm test`. Every other job depends on it, so a red suite
+  blocks all deploys.
+- **`build`** — a two-entry matrix producing the only two web builds in the
+  run: `pnpm build` (base `""`, artifact `web-build`) and `pnpm build:gh`
+  (base `/loto`, artifact `web-build-gh`).
+- **`deploy-pages`** — canonical deploy; publishes `web-build-gh`.
+- **`deploy-firebase`** / **`preview-firebase`** — Firebase live channel on
+  `main`, preview channel on same-repo PRs; both consume `web-build`.
+- **`android-debug`** — syncs `web-build` into the Capacitor project and
+  assembles an unsigned APK.
+
+Tags run `.github/workflows/android-release.yml` instead, which builds the
+web app itself because no `ci` run exists to take artifacts from.
 
 ## Performance Checklist
 

web/docs/project-overview-pdr.md

@@ -86,7 +86,7 @@ State is entirely client-side. Each card / panel instance uses a unique localSto
 
 ## Deployment
 
-- **Production**: GitHub Pages at `https://tiennm99.github.io/loto/` (canonical, basePath `/loto`). Deployed by `.github/workflows/web-deploy-github-pages.yml` on push to `main`.
+- **Production**: GitHub Pages at `https://tiennm99.github.io/loto/` (canonical, basePath `/loto`). Deployed by the `deploy-pages` job in `.github/workflows/ci.yml` on push to `main`.
 - **Development**: `npm run dev` (local), `npm run dev:codeserver` (code-server via proxy).
 - **Build**: `npm run build:gh` generates static export to `build/` directory with the `/loto` basePath.
 

web/docs/system-architecture.md

@@ -74,7 +74,7 @@ npm run build:gh
 basePath="/loto"
 Output: build/index.html with /loto prefix
 Deploy: https://tiennm99.github.io/loto/
-Workflow: .github/workflows/web-deploy-github-pages.yml
+Workflow: .github/workflows/ci.yml (build "gh" -> deploy-pages)
 ```
 
 ### Development (Local)