test(supercharge): comprehensive test suite overhaul — all 11 points

Infrastructure: - .github/workflows/ci.yml: GitHub Actions CI that fires only on PRs targeting main and merge commits landing on main (dev→main gate). Spins up a Postgres service container, runs mypy, pytest -n auto with coverage, and uploads to Codecov. - Makefile: test, test-fast, test-cov, test-k, typecheck, seed, seed-local, migrate, docker-up/down/rebuild/nuke/logs, clean targets. - pyproject.toml: add pytest-xdist ≥3.5 and factory-boy ≥3.3 to dev dependencies; configure addopts with -p no:randomly for xdist compat.

Fixtures / factories: - tests/conftest.py: set ACCESS_TOKEN_SECRET default before any musehub imports so auth fixtures work in local (non-Docker) runs; make _reset_variation_store resilient to ModuleNotFoundError (module extracted to cgcardona/muse); remove lru_cache-busting workaround. - tests/factories.py: factory_boy Factory classes + async create_* helpers for MusehubRepo, MusehubBranch, MusehubCommit, MusehubProfile and a create_repo_with_branch convenience function.

Existing test fixes: - test_musehub_ui.py: remove 6 stale @pytest.mark.skip decorators — loadForkedRepos, loadStarredRepos, loadWatchedRepos, userCardHtml, loadFollowTab, tab-btn-followers all present in profile.html. - test_musehub_objects.py: replace module-level _OBJ_COUNTER global with uuid4-derived suffix per call — safe for xdist parallel workers. - test_musehub_auth.py: collapse 7 near-identical write-endpoint tests into a single @pytest.mark.parametrize; add GET-list parametrize for 404-without-auth cases; add body-field assertions to happy-path tests.

New test files (6): - test_musehub_auth_security.py: expired JWT, tampered JWT, alg=none, garbage token, missing header — all verified to return 401; unit tests for validate_access_code edge cases and revocation cache via HTTP. - test_musehub_revocation_cache.py: full unit coverage of get/set/clear, TTL expiry, eviction on read, overwrite semantics, hash_token contract. - test_musehub_release_packager.py: pure unit tests for build_download_urls and build_empty_download_urls covering all flag combinations. - test_musehub_muse_cli.py: compute_snapshot_id (order-independence, canonical hash) and compute_commit_id (parent sort, regression fixture). - test_musehub_contracts.py: canonical_contract_dict field exclusions, _normalize_value type coercions, nested dataclass recursion. - test_musehub_sessions_service.py: upsert/list/get lifecycle, ordering, repo isolation, limit parameter. - test_musehub_profile_service.py: CRUD, update_profile, contribution graph shape, public-repo filter, session credits baseline. - test_musehub_api_contracts.py: deep body-assertion tests for repos, branches, commits, issues, explore — field types, envelope structure, camelCase keys verified end-to-end. - test_musehub_alembic.py: alembic upgrade/downgrade/re-upgrade smoke test; auto-skipped locally (no Postgres), runs in CI Postgres service.

musehub/config.py: add extra="ignore" to SettingsConfigDict so unknown env vars (e.g. OPENROUTER_API_KEY from other tools) don't break startup.