feat(atlas): Phase B — data-driven /api/atlas.json, CI stage generated from cd.yml

The atlas no longer hand-maintains its content. Authored data lives in one place
(internal/atlas/atlas.json); the Go layer overlays sourced facts and serves the
result at /api/atlas.json; the frontend fetches + renders (inline arrays kept only
as an offline fallback). First generated source: the CI/CD stage's nodes are parsed
from the repo's own .gitea/workflows/cd.yml — so the viz shows the pipeline that
actually runs (guard/check/build/deploy), dropping the aspirational var-go/oath-gate
node that isn't wired yet. That's the point: it can't drift from the real pipeline.

New internal/atlas package (JobsFromWorkflow, Build) built test-first. Adds
gopkg.in/yaml.v3 (justified: parsing the workflow YAML; stdlib has no YAML).

Verified: go build/vet/lint(0)/test green; /api/atlas.json → 9 stages, CI = real
jobs; frontend renders from the fetch (screenshot).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

internal/atlas/workflow_test.go

@@ -0,0 +1,45 @@
+package atlas_test
+
+import (
+	"reflect"
+	"testing"
+
+	"git.d-ma.be/mathias/cad-atlas/internal/atlas"
+)
+
+func TestJobsFromWorkflow_ReturnsJobNamesInDocumentOrder(t *testing.T) {
+	workflow := []byte(`
+name: CD
+"on":
+  push:
+    branches: [main]
+jobs:
+  guard:
+    runs-on: self-hosted
+  check:
+    needs: guard
+    runs-on: self-hosted
+  build:
+    needs: [guard, check]
+    runs-on: self-hosted
+  deploy:
+    needs: [guard, build]
+    runs-on: self-hosted
+`)
+
+	jobs, err := atlas.JobsFromWorkflow(workflow)
+	if err != nil {
+		t.Fatalf("JobsFromWorkflow: %v", err)
+	}
+
+	want := []string{"guard", "check", "build", "deploy"}
+	if !reflect.DeepEqual(jobs, want) {
+		t.Fatalf("jobs = %v, want %v", jobs, want)
+	}
+}
+
+func TestJobsFromWorkflow_ErrorsOnMalformedYAML(t *testing.T) {
+	if _, err := atlas.JobsFromWorkflow([]byte("jobs: [this is: not valid")); err == nil {
+		t.Fatal("expected error on malformed YAML, got nil")
+	}
+}