Integrate published SDKs in 20 standalone final tutorials and add CI

[EgorMajj]

Summary

Related changes: starter #1, documentation #62.

• Upgrade all 20 independent final apps to pinned published @shieldlabs-ai/js and @shieldlabs-ai/node 1.0.1.
• Add standalone checkout-risk starter/final teaching behavior, preserve independent frontend/backend/SQLite/package locks, and isolate per-app session cookies.
• Keep Private API Keys server-side; show setup guidance without starting the agent when keys are absent or placeholders.
• Serialize browser checks, use server History normalization, consume request IDs atomically, fail closed for missing/stale/replayed/future/unusable observations, and preserve scenario-specific outcomes.
• Cover late-risk rereads and reset during pending verification. Add wrong-request History and simultaneous replay regressions to all 20 apps.
• Add read-only CI for 20 apps x Node 22/24 with pinned actions, clean runtime install, syntax/native checks and dependency audit.

Verification

Remote CI passed on the uploaded head: 40/40 jobs across Node 22/24. Run. This is synthetic CI, not a completed live final run.

• 480 native final tests passed locally on Node 24; all 20 folder contracts and all JavaScript syntax checks passed.
• Runtime audit: 0 known vulnerabilities in all 20 apps.
• Earlier browser checks: all 20 final setup states passed without keys.
• Full genuine browser + live scoring + History + UI path passed checkout-risk and new-account-fraud only.
• Live final run remains incomplete: challenge returned HTTP 429 on account-sharing, with no History row. A later retry was rejected before sending a new identification. No bypass, IP switching or limiter weakening.

Do not treat as a live release approval

• Finish the remaining 18 genuine browser paths and multi-device/repeat/signed-in checks after the service owner confirms safe recovery.
• Test ordinary customer keys on a registered HTTPS hostname; the internal demo key's loopback success does not prove customer localhost support.
• The 11-second reread is a demo precaution, not an API finality guarantee.
• These are teaching apps, not drop-in production auth/payment/lending modules: production session/action binding, admin authorization, secure hosting and shared durable replay storage remain the integrator's responsibilities.

Target: final. Draft for review; no merge or dev/prod deployment. No account keys or QA databases are included. Keep the repository private.