[Blocker] Add a PR CI workflow and make tests gate the deploy

Tier 1 — release blocker

Problem

Three separate gaps:

1. The deploy workflow runs tests with continue-on-error: true, so a failing test never blocks a production deploy.
2. It runs dotnet test --no-build at solution level after building only LearnStack.csproj, so the test project is likely never built and the tests probably do not execute at all — the swallowed error hides this.
3. There is no PR build workflow at all: the only workflow triggers on push to main and deploys straight to production.

Evidence

• .github/workflows/azure-app-service.yml:91-92
• .github/workflows/ contains only azure-app-service.yml

Proposed fix

1. Add .github/workflows/ci.yml: restore, build LearnStack.sln, dotnet test on pull_request and push.
2. Mark it a required status check on main.
3. In the deploy workflow, build the solution and drop continue-on-error.

Acceptance criteria

• A PR with a failing test cannot be merged
• A failing test blocks the deploy job
• Test results are visible in the workflow summary

Start by reading .github/workflows/azure-app-service.yml around lines 91-92 and inspect the LearnStack.sln and LearnStack.csproj build targets. Add .github/workflows/ci.yml using restore, solution build, and dotnet test for pull requests and pushes, then update the deploy workflow. Done means required PR checks and deploy tests visibly fail on test failure, with the workflow summary showing results.