Keep the engine's state in SQLite, not Postgres

One process owns this database — the image has run a single uvicorn
worker for that reason since the four-engines bug — so a file beside the
flows is the honest shape for it, and it is what lets `fluksio serve`
need no infrastructure at all. Live values, node execution and the work
queue never came here anyway; what does is a rollup a minute at a time,
a row per cascade and the run history, and WAL keeps the readers going
while that one writer works.

DATA_DIR is now the one setting that moves everything an installation
keeps; the rest derive from it and the images still spell theirs out.
The schema is prepared in-process at startup, so the prestart service is
gone, and the ten Postgres-only revisions collapse into one portable
baseline.

Three things only worked because psycopg was casting for us: a token's
subject arriving as a string where the column is a UUID, `greatest`, and
`date_bin`. The timestamps needed a column type of their own — SQLite
stores no offset, and a naive datetime read back either raises against an
aware `now` or serialises as local time.

Postgres stays in the stack only for Umami, behind the analytics profile.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

.gitea/workflows/test-backend.yml

@@ -39,30 +39,16 @@ jobs:
             pyproject.toml
             backend/pyproject.toml
             uv.lock
-      - name: Write .env
-        # Not committed, and both compose and the backend settings need it.
-        # The suite runs on the runner and reaches the container over
-        # POSTGRES_SERVER=localhost from there, on the port resolved below.
-        run: cp .env.example .env
-      - run: docker compose down -v --remove-orphans
-      # Postgres is the only service the suite needs: the mail paths are
-      # patched in tests/, and the flow engine falls back to in-memory state
-      # while REDIS_HOST is empty.
-      - run: docker compose up -d --wait db
-      - name: Resolve the db port
-        # Docker assigns it (docker/compose.ci.yml), so concurrent runs get one
-        # each. An env var outranks the .env file in the backend settings.
-        run: |
-          echo "POSTGRES_PORT=$(docker compose port db 5432 | tail -n1 | cut -d: -f2)" >> "$GITHUB_ENV"
       - run: uv sync
-      - name: Migrate DB and seed the superuser
-        run: uv run bash scripts/prestart.sh
-        working-directory: backend
-      # scripts/tests-start.sh waits for the DB, then runs pytest under
-      # coverage and prints the report (see backend/scripts/test.sh).
+      # Nothing to start: the suite names its own SQLite file in a temp
+      # directory (backend/tests/__init__.py), the mail paths are patched, and
+      # the flow engine falls back to in-memory state without a Redis host.
       - name: Run tests with coverage
-        run: uv run bash scripts/tests-start.sh "Coverage for ${{ github.sha }}"
+        run: uv run bash scripts/test.sh "Coverage for ${{ github.sha }}"
         working-directory: backend
-      - name: Tear down
-        if: always()
-        run: docker compose down -v --remove-orphans
+      - name: Check the wheels build
+        # Cheap, and it catches a data file that stopped being packaged —
+        # alembic's revisions and the email templates ride along by directory.
+        run: |
+          uv build --all-packages --out-dir dist
+          uv run --no-project --with dist/fluksio_worker-*.whl fluksio-worker --help

.gitea/workflows/test-compose.yml

@@ -47,8 +47,9 @@ jobs:
       # breaks silently.
       - run: docker compose build backend frontend
       - run: docker compose down -v --remove-orphans
-      # db and prestart come along as depends_on; --wait blocks on the backend
-      # healthcheck in docker/compose.yml.
+      # Redis comes along as a depends_on; --wait blocks on the backend
+      # healthcheck in docker/compose.yml, which is also what proves the
+      # schema was created before anything served a request.
       - run: docker compose up -d --wait backend frontend
       # Nothing is published on the host (compose.ci.yml), so the checks run
       # from inside the backend container against the project network.