feat(15-01): fix 13 markdown violations + wire md:lint to fast-checks CI step

- Fix MD040 (11 bare fences): add language tags (text/bash) across 7 files
- Fix MD031 (2 violations): add blank lines around fence in GETTING-STARTED.md
- Wire 'Markdown lint' step to fast-checks job (after Format check, before Typecheck)
- Reformat .markdownlint-cli2.jsonc per Prettier (trailing commas in JSONC)
- pnpm md:lint exits 0; pnpm format:check exits 0; gate can fail on bare fence (verified)

docs/API.md

@@ -514,7 +514,7 @@ Streams `heartbeat` events every 10 seconds indefinitely. Used as a Pangolin tun
 
 **Event format**
 
-```
+```text
 event: heartbeat
 id: 0
 data: {"ts":"2025-06-10T14:00:00.000Z","id":0}
@@ -541,7 +541,7 @@ A `heartbeat` event is sent every 30 seconds to keep the Pangolin connection ali
 
 **Event format example**
 
-```
+```text
 event: item:added
 id: 1-1718020800000
 data: {"type":"item:added","listId":1,"payload":{"id":11,"listId":1,"text":"Eggs"}}

docs/ARCHITECTURE.md

@@ -61,7 +61,7 @@ graph TD
 
 ## Directory Structure
 
-```
+```text
 familysync/
 ├── apps/
 │   ├── api/                  # Hono backend (Node 22 + TypeScript)
@@ -168,7 +168,7 @@ familysync/
 
 ### Backend modules
 
-```
+```text
 routes/events.ts  ──→  broker/expand.ts     (read: RRULE expansion)
                   ──→  calendarOutbox (DB)   (write: enqueue)
                   ──→  broker/sync.ts        (write-sync after outbox drain)

docs/DEVELOPMENT.md

@@ -6,7 +6,7 @@ Local development setup and workflows for FamilySync — a pnpm monorepo with tw
 
 ## Repo Layout
 
-```
+```text
 familysync/
 ├── apps/
 │   ├── api/          # Hono API server — Node.js 22, TypeScript, Drizzle/MariaDB
@@ -19,7 +19,7 @@ familysync/
 
 Key paths inside `apps/api/src/`:
 
-```
+```text
 src/
 ├── db/
 │   ├── schema.ts       # Drizzle table definitions (source of truth for migrations)

docs/GETTING-STARTED.md

@@ -49,9 +49,11 @@ Open `.env` and fill in the required values. See [docs/CONFIGURATION.md](CONFIGU
 
 - `DB_PASSWORD` and `DB_ROOT_PASSWORD` — pick any local passwords
 - `APP_PASSWORD_ENCRYPTION_KEY` — 64 hex characters; generate with:
+
   ```bash
   node -e "console.log(require('crypto').randomBytes(32).toString('hex'))"
   ```
+
 - `DEV_AUTH_BYPASS=true` — bypasses the live Authelia OIDC flow for local dev
 - `DB_HOST=localhost` — the dev Docker Compose exposes MariaDB on the host at `localhost:3306`