Add the Gitea Actions workflows

Ports n3xd's four: pre-commit, backend tests, sharded Playwright and a
compose smoke test. Everything comes from the committed .env.example, so
no repository secrets are needed; Actions still has to be enabled per
repository and a runner registered with the ubuntu-latest label.

container_name, published ports and image tags are all daemon-global, so
two shards on one runner would fight over them. compose.ci.yml resets
them and tags per project. test-backend keeps the fixed names because it
reaches Postgres from the runner host.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KkmeRiyeYmVZqJVwuyHq9o

.gitea/workflows/test-backend.yml

@@ -0,0 +1,58 @@
+name: Test Backend
+
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+    types:
+      - opened
+      - synchronize
+
+env:
+  # The compose files live in docker/, so a bare `docker compose` from the repo
+  # root finds nothing. With COMPOSE_FILE set, compose reads .env from the
+  # working directory — the same file the backend settings load as ../.env.
+  # The CI-only project name keeps the `down -v` steps away from a dev stack.
+  COMPOSE_FILE: docker/compose.yml:docker/compose.dev.yml
+  COMPOSE_PROJECT_NAME: fluksio-app-ci
+
+jobs:
+  test-backend:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.10"
+      - name: Set up uv
+        uses: astral-sh/setup-uv@v7
+        with:
+          cache-dependency-glob: |
+            pyproject.toml
+            backend/pyproject.toml
+            uv.lock
+      - name: Write .env
+        # Not committed, and both compose and the backend settings need it.
+        # POSTGRES_SERVER=localhost there matches the port db publishes in the
+        # dev overlay, so the suite runs on the runner against the container.
+        run: cp .env.example .env
+      - run: docker compose down -v --remove-orphans
+      # Postgres is the only service the suite needs: the mail paths are
+      # patched in tests/, and the flow engine falls back to in-memory state
+      # while REDIS_HOST is empty.
+      - run: docker compose up -d --wait db
+      - run: uv sync
+      - name: Migrate DB and seed the superuser
+        run: uv run bash scripts/prestart.sh
+        working-directory: backend
+      # scripts/tests-start.sh waits for the DB, then runs pytest under
+      # coverage and prints the report (see backend/scripts/test.sh).
+      - name: Run tests with coverage
+        run: uv run bash scripts/tests-start.sh "Coverage for ${{ github.sha }}"
+        working-directory: backend
+      - name: Tear down
+        if: always()
+        run: docker compose down -v --remove-orphans