ci(quality): add a prettier format-check gate

Wire `pnpm format:check` into the Lint/Typecheck/Test job and extend
.prettierignore so prettier never rewrites generator-owned artifacts:
the OpenAPI contract (whose exact bytes the openapi:check job enforces),
the build-emitted service worker, the Prisma client, and the lockfile.

.github/workflows/security.yml

@@ -33,6 +33,12 @@ jobs:
       - name: ESLint
         run: pnpm lint
 
+      # Prettier formatting gate. The format pass excludes generator-owned
+      # artifacts via .prettierignore (notably docs/api/openapi.yaml, which
+      # the OpenAPI drift check below enforces byte-for-byte).
+      - name: Prettier format check
+        run: pnpm format:check
+
       - name: TypeScript strict check
         run: pnpm typecheck