feat: add validated Geoapify import and complete Venue model

[andss]

This adds a reproducible Geoapify-to-PostgreSQL import workflow for Trondheim and completes the agreed 16-field Venue model. A completed source collection becomes a validated seed file; repeat imports preserve venue IDs and app review data.

• Fetch city-boundary results with pagination, details, duplicate handling and retained source records.
• Normalize clear weekly opening hours into calendar-day intervals. Missing or uncertain schedules stay unknown, with their original expressions and review reasons retained.
• Validate coordinates, time intervals, HTTP(S) URLs, source identities and optional fields before connecting to the database. Support an explicit input file and a dry run.
• Add the five remaining Venue fields through an additive migration and expose them through GraphQL. Store attribution and original source metadata in venue_sources.raw_data.
• Document the model and import/setup workflow in English, and add backend checks to PR CI.

Validation:

• 56 tests pass, including PostgreSQL migrations, constraints, rollback, repeat imports and GraphQL.
• Backend type checking and build pass; changed files pass Prettier.
• The actual 51-venue export was imported twice into an isolated PGlite database: 51 inserts, then 51 updates with no new records. IDs, app review values and source metadata were preserved; all 16 GraphQL fields were read successfully.
• Opening hours: 24 normalized, 19 missing, 8 requiring review. Unsupported schedules remain [].

VM connectivity, migrations and import have not been run yet; database credentials and an SSH tunnel are still needed. Apply both Venue migrations before using the expanded GraphQL queries. Frontend GraphQL integration and search/filter/sort/pagination remain separate work. Real exports and credentials are ignored by Git.

Implementation and tests were prepared with Codex and verified locally.

[alekskjo]

Looks good! This PR is the planned follow-up to #50: it builds on the existing foundation while adding substantial new functionality for validation, importing, migrations, source metadata, and testing.

All checks are green, and the import has been verified locally with 51 venues without duplicates. The tapfinder_app password is not needed for reviewing or merging this PR. It is only needed later when running the migration and import against the database on the VM, and it should be shared privately—not in GitHub.

Approved ✅