Add the Gitea Actions workflows

Ports n3xd's four: pre-commit, backend tests, sharded Playwright and a
compose smoke test. Everything comes from the committed .env.example, so
no repository secrets are needed; Actions still has to be enabled per
repository and a runner registered with the ubuntu-latest label.

container_name, published ports and image tags are all daemon-global, so
two shards on one runner would fight over them. compose.ci.yml resets
them and tags per project. test-backend keeps the fixed names because it
reaches Postgres from the runner host.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KkmeRiyeYmVZqJVwuyHq9o

.gitea/workflows/pre-commit.yml

@@ -0,0 +1,53 @@
+name: pre-commit
+
+# Gitea Actions. `uses:` is resolved against the instance's action mirror, the
+# same convention the sibling N3XD repositories use — plain `owner/action@tag`.
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+    types:
+      - opened
+      - synchronize
+
+jobs:
+  pre-commit:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+      - uses: oven-sh/setup-bun@v2
+      # Matches backend/Dockerfile, so the gate type-checks and formats against
+      # the interpreter the image ships.
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.10"
+      - name: Set up uv
+        uses: astral-sh/setup-uv@v7
+        with:
+          cache-dependency-glob: |
+            pyproject.toml
+            backend/pyproject.toml
+            uv.lock
+      - name: Write .env
+        # Not committed, and the generate-frontend-sdk hook imports the backend
+        # settings, which read ../.env from backend/.
+        run: cp .env.example .env
+      # The hooks call `uv run ruff` from the repo root, so the workspace .venv
+      # (pyproject.toml → [tool.uv.workspace]) is what has to exist.
+      - name: Install backend dependencies
+        run: uv sync
+      - name: Install frontend dependencies
+        run: bun install --frozen-lockfile
+      # The formatting hooks rewrite files; pre-commit exits non-zero when they
+      # do, which fails the run. No auto-commit branch here: that needs a push
+      # token, and pre-commit-ci/lite-action talks to a GitHub-only service.
+      - name: Run pre-commit
+        run: uvx pre-commit run --all-files --show-diff-on-failure
+      # The hooks cover ruff and biome but not mypy, which `make lint-backend`
+      # runs and which is strict for everything outside the flow prototypes.
+      - name: Typecheck backend
+        run: uv run mypy app
+        working-directory: backend