T-3: add Gitea Actions CI/CD pipeline

Single workflow with three jobs:
- backend-test: JDK 25, ./mvnw -B verify (Checkstyle, JUnit, ArchUnit, SpotBugs)
- frontend-test: Node 24, lint, type generation, type-check, unit tests, production build
- build-and-publish: Buildah image build + push with rolling SemVer tags (only on vX.Y.Z tags)

Includes research report and implementation plan.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

.gitea/workflows/ci.yaml

@@ -0,0 +1,92 @@
+name: CI
+
+on:
+  push:
+
+jobs:
+  backend-test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up JDK 25
+        uses: actions/setup-java@v4
+        with:
+          distribution: temurin
+          java-version: 25
+
+      - name: Run backend verify
+        run: cd backend && ./mvnw -B verify
+
+  frontend-test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up Node 24
+        uses: actions/setup-node@v4
+        with:
+          node-version: 24
+
+      - name: Install dependencies
+        run: cd frontend && npm ci
+
+      - name: Lint
+        run: cd frontend && npm run lint
+
+      - name: Generate API types
+        run: cd frontend && npm run generate:api
+
+      - name: Type check
+        run: cd frontend && npm run type-check
+
+      - name: Unit tests
+        run: cd frontend && npm run test:unit -- --run
+
+      - name: Production build
+        run: cd frontend && npm run build
+
+  build-and-publish:
+    needs: [backend-test, frontend-test]
+    if: startsWith(github.ref, 'refs/tags/') && contains(github.ref_name, '.')
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Parse SemVer tag
+        id: semver
+        run: |
+          TAG="${{ github.ref_name }}"
+          if [[ ! "$TAG" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+            echo "Not a valid SemVer tag: $TAG"
+            exit 1
+          fi
+          MAJOR="${TAG%%.*}"
+          MINOR="${TAG%.*}"
+          echo "full=$TAG" >> "$GITHUB_OUTPUT"
+          echo "minor=$MINOR" >> "$GITHUB_OUTPUT"
+          echo "major=$MAJOR" >> "$GITHUB_OUTPUT"
+
+      - name: Build image
+        run: |
+          REGISTRY="${{ github.server_url }}"
+          REGISTRY="${REGISTRY#https://}"
+          REGISTRY="${REGISTRY#http://}"
+          REPO="${{ github.repository }}"
+          IMAGE="${REGISTRY}/${REPO}"
+          buildah bud -t "${IMAGE}:${{ steps.semver.outputs.full }}" .
+          buildah tag "${IMAGE}:${{ steps.semver.outputs.full }}" \
+            "${IMAGE}:${{ steps.semver.outputs.minor }}" \
+            "${IMAGE}:${{ steps.semver.outputs.major }}" \
+            "${IMAGE}:latest"
+          echo "IMAGE=${IMAGE}" >> "$GITHUB_ENV"
+
+      - name: Push to registry
+        run: |
+          buildah login -u "${{ github.repository_owner }}" \
+            -p "${{ secrets.REGISTRY_TOKEN }}" \
+            "${IMAGE%%/*}"
+          buildah push "${IMAGE}:${{ steps.semver.outputs.full }}"
+          buildah push "${IMAGE}:${{ steps.semver.outputs.minor }}"
+          buildah push "${IMAGE}:${{ steps.semver.outputs.major }}"
+          buildah push "${IMAGE}:latest"