chore: add commit hooks and conventional commit enforcement

[emmanuel]

First of three stacked PRs. Merge order is this, then #8, then #9; each
retargets to master as its parent lands.

husky wires two hooks:

• pre-commit runs lint-staged — eslint --fix and prettier --write over
  staged files only, so formatting is fixed at commit time rather than caught
  later by CI.
• commit-msg runs commitlint against @commitlint/config-conventional.

The type list is closed rather than left to the default, because release-please
(#8) keys off these types and an unrecognised one would silently produce no
release entry. Body and footer line-length rules are off — commit bodies in this
repo carry reasoning and pasted command output, and wrapping is a review concern
rather than grounds to reject a commit.

The CI job lints the PR title, not the commits

We squash-merge, so the PR title becomes the commit subject on master, and that
is the message release-please will read. The commit-msg hook covers individual
commits locally, but squashing discards them — enforcing only locally would
leave the one message that actually lands unchecked.

Verified rather than assumed

• commitlint rejects a non-conventional message, and rejects an unknown type
  with the allowed list.
• lint-staged reformatted a deliberately misformatted staged file.
• The hooks then rejected my own WIP: commit while I was building this branch,
  which is the behaviour working as intended.

Formatting and lint are already checked across the whole tree by npm test,
which CI runs, so the hooks are a faster local echo of an existing check rather
than new coverage.