ci(gitea): add CI workflow + transient smoke validation

Two workflows under .gitea/workflows/:

- ci.yml — runs on push:main and every PR. Two parallel jobs:
  * backend (python:3.12-slim-bookworm): apt deps for psycopg + WeasyPrint,
    pip install -e backend[dev], ruff check + ruff format --check + mypy
    --strict src + pytest tests/unit. Postgres 16 service for any
    integration-style test, env wired via service hostname.
    FERNET_KEY_TEST sourced from Gitea repo secret (no plain value in CI).
  * frontend (node:22-alpine): npm ci, ESLint, TypeScript typecheck,
    Vitest, Vite build.
  Runner label: linux (matches gitea-runner registration).
  Out of scope sprint 0: testcontainers Postgres integration tests
  (Docker-in-Docker rootless setup deferred to nightly job) and
  Playwright E2E (deferred to sprint 1+).

- smoke.yml — transient. Triggers only on push to this branch
  (chore/podman-and-ci) and on workflow_dispatch. Validates that the
  newly registered gitea-runner picks up jobs with the "linux" label.
  Removed in a follow-up commit on this branch once green.

.gitea/workflows/smoke.yml

@@ -0,0 +1,22 @@
+name: smoke
+# Trivial workflow to validate the Gitea Actions runner pickup.
+# Removed in a follow-up commit once green on chore/podman-and-ci.
+
+on:
+  push:
+    branches:
+      - chore/podman-and-ci
+  workflow_dispatch:
+
+jobs:
+  hello:
+    runs-on: linux
+    steps:
+      - name: kernel + identity
+        run: |
+          echo "host: $(uname -a)"
+          id
+          cat /etc/os-release | head -3
+      - name: container runtime visible from job
+        run: |
+          which podman || which docker || echo "(no runtime visible — expected for nested rootless DooD)"