chore: add version-controlled git hooks + installer

pre-commit runs fast checks (block committed .env/secrets, verify dotnet
format); pre-push mirrors CI (Release build + tests + frontend build) to catch
failures before they leave the machine. install-hooks.ps1 wires core.hooksPath
so the hooks are shared and reviewable rather than living in un-tracked
.git/hooks. Bypass with --no-verify; CI still enforces the gate server-side.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

scripts/git-hooks/pre-push

@@ -0,0 +1,21 @@
+#!/usr/bin/env sh
+# InboxIntel pre-push hook — build + test gate. Mirrors what Gitea CI runs so you
+# catch failures before they reach the server. Bypass with: git push --no-verify
+set -eu
+
+echo "[pre-push] building solution (Release)..."
+dotnet build InboxIntel.sln -c Release --nologo \
+  || { echo "[pre-push] BLOCKED: backend build failed."; exit 1; }
+
+echo "[pre-push] running tests..."
+dotnet test InboxIntel.sln -c Release --no-build --nologo \
+  || { echo "[pre-push] BLOCKED: tests failed."; exit 1; }
+
+# Frontend build (only if the app is present and npm is installed).
+if [ -f frontend/package.json ] && command -v npm >/dev/null 2>&1; then
+  echo "[pre-push] frontend build..."
+  ( cd frontend && npm run build --silent ) \
+    || { echo "[pre-push] BLOCKED: frontend build failed."; exit 1; }
+fi
+
+echo "[pre-push] OK — safe to push."