Add the Gitea Actions workflows

Ports n3xd's four: pre-commit, backend tests, sharded Playwright and a
compose smoke test. Everything comes from the committed .env.example, so
no repository secrets are needed; Actions still has to be enabled per
repository and a runner registered with the ubuntu-latest label.

container_name, published ports and image tags are all daemon-global, so
two shards on one runner would fight over them. compose.ci.yml resets
them and tags per project. test-backend keeps the fixed names because it
reaches Postgres from the runner host.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KkmeRiyeYmVZqJVwuyHq9o

.gitea/workflows/playwright.yml

@@ -0,0 +1,107 @@
+name: Playwright Tests
+
+on:
+  push:
+    branches:
+      - main
+    paths:
+      - backend/**
+      - frontend/**
+      - docker/compose*.yml
+      - .env.example
+      - .gitea/workflows/playwright.yml
+  pull_request:
+    types:
+      - opened
+      - synchronize
+    paths:
+      - backend/**
+      - frontend/**
+      - docker/compose*.yml
+      - .env.example
+      - .gitea/workflows/playwright.yml
+
+env:
+  # The playwright runner service comes from the dev overlay. It loads the SPA
+  # from the nginx `frontend` service and reaches the API as http://backend:8000
+  # on the project network — both wired up in compose.ci.yml.
+  COMPOSE_FILE: docker/compose.yml:docker/compose.dev.yml:docker/compose.ci.yml
+  # frontend/playwright.config.ts keys the blob reporter, the retries and
+  # forbidOnly off CI, and compose.dev.yml forwards it into the container.
+  CI: "true"
+
+jobs:
+  test-playwright:
+    runs-on: ubuntu-latest
+    timeout-minutes: 60
+    strategy:
+      fail-fast: false
+      matrix:
+        # Two spec files (tests/flows.spec.ts, tests/admin.spec.ts) plus
+        # tests/auth.setup.ts, which every shard reruns as its setup project.
+        # More shards than that would only pay container startup twice over.
+        shardIndex: [1, 2]
+        shardTotal: [2]
+    env:
+      # One stack per shard, so a `down -v` cannot reach the other shard's
+      # volumes. compose.ci.yml above drops the fixed container_names and host
+      # ports, which the project name does not cover — without it two shards on
+      # the same runner host collide on the daemon-global names.
+      COMPOSE_PROJECT_NAME: fluksio-app-ci-pw-${{ matrix.shardIndex }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+      - name: Write .env
+        # Not committed; compose interpolates it and the runner container reads
+        # FIRST_SUPERUSER / FIRST_SUPERUSER_PASSWORD out of it (tests/config.ts).
+        run: cp .env.example .env
+      - run: docker compose build backend frontend playwright
+      - run: docker compose down -v --remove-orphans
+      # PLAYWRIGHT_BASE_URL points the browser at `frontend`, which is not a
+      # dependency of the playwright service, so bring it up explicitly.
+      - run: docker compose up -d --wait backend frontend
+      - name: Run Playwright tests
+        run: >-
+          docker compose run --rm playwright
+          bunx playwright test --trace=retain-on-failure
+          --shard=${{ matrix.shardIndex }}/${{ matrix.shardTotal }}
+      - name: Tear down
+        if: always()
+        run: docker compose down -v --remove-orphans
+      - name: Upload blob report
+        if: ${{ !cancelled() }}
+        uses: actions/upload-artifact@v4
+        with:
+          name: blob-report-${{ matrix.shardIndex }}
+          path: frontend/blob-report
+          include-hidden-files: true
+          retention-days: 1
+
+  merge-reports:
+    needs:
+      - test-playwright
+    # Merge even when a shard failed — that report is the one worth reading.
+    if: ${{ !cancelled() }}
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+      - uses: oven-sh/setup-bun@v2
+      - name: Install dependencies
+        run: bun install --frozen-lockfile
+      - name: Download blob reports
+        uses: actions/download-artifact@v4
+        with:
+          path: frontend/all-blob-reports
+          pattern: blob-report-*
+          merge-multiple: true
+      - name: Merge into an HTML report
+        run: bunx playwright merge-reports --reporter html ./all-blob-reports
+        working-directory: frontend
+      - name: Upload HTML report
+        uses: actions/upload-artifact@v4
+        with:
+          name: html-report--attempt-${{ github.run_attempt }}
+          path: frontend/playwright-report
+          include-hidden-files: true
+          retention-days: 7