ci(quality): add a prettier format-check gate

Wire `pnpm format:check` into the Lint/Typecheck/Test job and extend
.prettierignore so prettier never rewrites generator-owned artifacts:
the OpenAPI contract (whose exact bytes the openapi:check job enforces),
the build-emitted service worker, the Prisma client, and the lockfile.

.github/workflows/security.yml

@@ -33,6 +33,12 @@ jobs:
       - name: ESLint
         run: pnpm lint
 
+      # Prettier formatting gate. The format pass excludes generator-owned
+      # artifacts via .prettierignore (notably docs/api/openapi.yaml, which
+      # the OpenAPI drift check below enforces byte-for-byte).
+      - name: Prettier format check
+        run: pnpm format:check
+
       - name: TypeScript strict check
         run: pnpm typecheck
 

.prettierignore

@@ -2,5 +2,17 @@ node_modules
 .next
 out
 build
+coverage
+
+# Prisma-generated client.
 src/generated
+
+# Lockfile — owned by pnpm.
 pnpm-lock.yaml
+
+# Generator-owned API contract. The openapi:check job enforces its exact
+# bytes against the Zod registry, so prettier must never rewrite it.
+docs/api/openapi.yaml
+
+# Build-generated service worker (the PWA build emits it).
+public/sw.js