feat(15-01): fix 13 markdown violations + wire md:lint to fast-checks CI step

- Fix MD040 (11 bare fences): add language tags (text/bash) across 7 files
- Fix MD031 (2 violations): add blank lines around fence in GETTING-STARTED.md
- Wire 'Markdown lint' step to fast-checks job (after Format check, before Typecheck)
- Reformat .markdownlint-cli2.jsonc per Prettier (trailing commas in JSONC)
- pnpm md:lint exits 0; pnpm format:check exits 0; gate can fail on bare fence (verified)

.gitea/workflows/ci.yml

@@ -31,6 +31,9 @@ jobs:
       - name: Format check
         run: pnpm format:check
 
+      - name: Markdown lint
+        run: pnpm md:lint
+
       - name: Typecheck
         run: pnpm typecheck
 

.markdownlint-cli2.jsonc

@@ -16,8 +16,8 @@
     // Rules DISABLED (Prettier owns these OR they fire on non-author-controlled files):
     "MD041": false, // first-line-h1: CLAUDE.md legitimately starts with ## Project
     "MD034": false, // no-bare-urls: CLAUDE.md version table uses pkg@version syntax
-    "MD036": false // no-emphasis-as-heading: docs/API.md uses **Response 200** as label
+    "MD036": false, // no-emphasis-as-heading: docs/API.md uses **Response 200** as label
   },
   "globs": ["docs/**/*.md", "*.md", "apps/**/*.md"],
-  "ignores": [".planning/**", "node_modules/**", "**/node_modules/**", ".pnpm-store/**"]
+  "ignores": [".planning/**", "node_modules/**", "**/node_modules/**", ".pnpm-store/**"],
 }

README.md

@@ -75,7 +75,7 @@ The API listens on port 3000. The PWA build is served separately (Vite `preview`
 
 ## Monorepo Structure
 
-```
+```text
 apps/
   api/        Hono backend — CalDAV sync, OIDC auth, lists API, push notifications
   pwa/        React 19 PWA — calendar view, lists UI, service worker
@@ -116,7 +116,7 @@ docker-compose.dev.yml   Dev overrides (bind-mount src/, expose DB/Redis ports)
 
 FamilySync reads and writes calendars via CalDAV against Fastmail — not JMAP (not available for Fastmail calendars). Configure your Fastmail app password under the "Mail, Contacts & Calendars" scope. The principal URL follows the pattern:
 
-```
+```text
 https://caldav.fastmail.com/dav/principals/user/<your-fastmail-address>/
 ```
 

apps/api/README.md

@@ -16,7 +16,7 @@ Part of the [FamilySync monorepo](../../README.md).
 
 ## Source layout
 
-```
+```text
 src/
   index.ts              Hono app entrypoint; server startup; background worker initialization
   routes/

apps/pwa/README.md

@@ -42,7 +42,7 @@ The API backend must also be running for most features. See [GETTING-STARTED.md]
 
 ## Source layout
 
-```
+```text
 src/
   api/          # Typed fetch wrappers for @familysync/api (client.ts, listsClient.ts)
   components/   # Shared UI components co-located with their *.test.tsx files

apps/pwa/e2e/README.md

@@ -73,7 +73,7 @@ Set `DB_PASSWORD` (and other non-default values) via the shell or the repo root
 
 The API enforces this via `apps/api/src/auth/devBypass.ts`:
 
-```
+```text
 if (process.env.NODE_ENV === 'production') → bypass is a no-op (always)
 if (process.env.DEV_AUTH_BYPASS !== 'true') → bypass is a no-op
 ```

docs/API.md

@@ -514,7 +514,7 @@ Streams `heartbeat` events every 10 seconds indefinitely. Used as a Pangolin tun
 
 **Event format**
 
-```
+```text
 event: heartbeat
 id: 0
 data: {"ts":"2025-06-10T14:00:00.000Z","id":0}
@@ -541,7 +541,7 @@ A `heartbeat` event is sent every 30 seconds to keep the Pangolin connection ali
 
 **Event format example**
 
-```
+```text
 event: item:added
 id: 1-1718020800000
 data: {"type":"item:added","listId":1,"payload":{"id":11,"listId":1,"text":"Eggs"}}

docs/ARCHITECTURE.md

@@ -61,7 +61,7 @@ graph TD
 
 ## Directory Structure
 
-```
+```text
 familysync/
 ├── apps/
 │   ├── api/                  # Hono backend (Node 22 + TypeScript)
@@ -168,7 +168,7 @@ familysync/
 
 ### Backend modules
 
-```
+```text
 routes/events.ts  ──→  broker/expand.ts     (read: RRULE expansion)
                   ──→  calendarOutbox (DB)   (write: enqueue)
                   ──→  broker/sync.ts        (write-sync after outbox drain)

docs/DEVELOPMENT.md

@@ -6,7 +6,7 @@ Local development setup and workflows for FamilySync — a pnpm monorepo with tw
 
 ## Repo Layout
 
-```
+```text
 familysync/
 ├── apps/
 │   ├── api/          # Hono API server — Node.js 22, TypeScript, Drizzle/MariaDB
@@ -19,7 +19,7 @@ familysync/
 
 Key paths inside `apps/api/src/`:
 
-```
+```text
 src/
 ├── db/
 │   ├── schema.ts       # Drizzle table definitions (source of truth for migrations)

docs/GETTING-STARTED.md

@@ -49,9 +49,11 @@ Open `.env` and fill in the required values. See [docs/CONFIGURATION.md](CONFIGU
 
 - `DB_PASSWORD` and `DB_ROOT_PASSWORD` — pick any local passwords
 - `APP_PASSWORD_ENCRYPTION_KEY` — 64 hex characters; generate with:
+
   ```bash
   node -e "console.log(require('crypto').randomBytes(32).toString('hex'))"
   ```
+
 - `DEV_AUTH_BYPASS=true` — bypasses the live Authelia OIDC flow for local dev
 - `DB_HOST=localhost` — the dev Docker Compose exposes MariaDB on the host at `localhost:3306`