ci: autofix annotations and lint on pull requests

[jaspermayone]

Summary

• Route annotations: adds the missing annotation lines in config/routes.rb (confirm_magic_link and the /profile/emails routes). This fixes annotate_check on main.
• annotate_check now uses a real database. Before, CI had no Postgres, so annotaterb skipped every model and reported "unchanged". Model drift was never caught. The job now starts postgres:17 and loads the schema.
• Routes are annotated in development. The committed annotations include dev-only routes (letter_opener, actual_db_schema). A test run would delete them.
• New Autofix workflow on pull requests from this repo:
  1. Loads the schema into Postgres.
  2. Runs annotaterb models and annotaterb routes.
  3. Runs bin/rubocop -a (safe corrections only).
  4. If files changed, commits chore: autofix annotations and lint to the PR branch as github-actions[bot].
  5. Starts CI for the new commit with workflow_dispatch.

flowchart LR
    P[PR opened or pushed] --> A[Autofix job]
    A --> D{Files changed?}
    D -- no --> E[Done]
    D -- yes --> C[Bot commits fix to PR branch]
    C --> W[workflow_dispatch CI on new commit]

Loading

Limits

• PRs from forks are skipped, because GITHUB_TOKEN cannot push to a fork.
• Offenses that RuboCop cannot fix safely still fail lint.
• The bot commit counts as a new push. The ruleset requires approval of the last push, so approve after the bot commit.
• GitHub marks pull_request runs for the bot commit as "action required". The dispatched CI run covers that commit.

Test plan

• Removed one route annotation on purpose. Autofix restored exactly that line (b41d857), and config/routes.rb matched the correct version again.
• Dispatched CI on the bot commit: lint, zeitwerk_check, scan_ruby, annotate_check all pass.
• annotaterb models --frozen against a fresh test database: no changes.