fix(fc2a): align CI with FabledRulebook — lint + short unit tests only

The CI failure resolving 'postgres' hostname was the symptom; the cause is
that the workflow violated FabledRulebook/forgejo.md's "CI philosophy —
lint + short unit tests only" rule. Integration tests against a real
Postgres are supposed to run locally via docker-compose, not in CI.

Changes:
- Marked 8 DB-dependent test files with @pytest.mark.integration:
  test_tag_service, test_importer, test_gallery_service, test_api_gallery,
  test_api_tags, test_api_settings, test_api_import_admin, test_maintenance.
- CI workflow drops the postgres/redis service containers and the alembic
  upgrade smoke step entirely.
- Pytest invocation in CI changes to `pytest -v -m "not integration"`.
- Added pytest marker registration to pyproject.toml.
- DB_PASSWORD and SECRET_KEY env vars retained because config.py reads
  them at import time even though unit tests don't actually use them
  (set to placeholder values).

What CI now runs:
- ruff check
- pytest on the 6 unit test files: test_slug, test_paths,
  test_migration_0002, test_thumbnailer, test_celery_smoke,
  test_tasks_register.
- npm install + npm run build

What CI no longer runs:
- alembic upgrade (no live DB)
- the 8 integration test files (these run locally via docker-compose)

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

.forgejo/workflows/ci.yml

@@ -1,5 +1,12 @@
 name: CI
 
+# Per FabledRulebook/forgejo.md: "CI runs analyzers + short unit tests.
+# Integration tests that need real Postgres/ffmpeg run locally via
+# docker-compose." So this workflow deliberately does NOT spin up service
+# containers; DB-dependent tests are marked `@pytest.mark.integration` and
+# excluded with `-m "not integration"`. To run integration tests, operator
+# uses docker-compose locally.
+
 on:
   push:
     branches: [dev, main]
@@ -12,34 +19,11 @@ jobs:
     # python-ci runner image lives at CI-Runner/CI-python/ in the operator's
     # workspace; see that Dockerfile + Makefile to roll/push the image.
     runs-on: python-ci
-    services:
-      postgres:
-        image: pgvector/pgvector:pg16
-        env:
-          POSTGRES_USER: fabledcurator
-          POSTGRES_PASSWORD: ci_test_password
-          POSTGRES_DB: fabledcurator_test
-        options: >-
-          --health-cmd "pg_isready -U fabledcurator"
-          --health-interval 10s
-          --health-timeout 5s
-          --health-retries 5
-      redis:
-        image: redis:7-alpine
-        options: >-
-          --health-cmd "redis-cli ping"
-          --health-interval 10s
-          --health-timeout 5s
-          --health-retries 5
     env:
-      DB_USER: fabledcurator
-      DB_PASSWORD: ci_test_password
-      DB_HOST: postgres
-      DB_PORT: "5432"
-      DB_NAME: fabledcurator_test
-      CELERY_BROKER_URL: redis://redis:6379/0
-      CELERY_RESULT_BACKEND: redis://redis:6379/0
-      SECRET_KEY: ci_test_secret_not_for_prod
+      # DB_PASSWORD and SECRET_KEY are required by config.py at import time
+      # even though unit tests don't actually touch the DB or use the secret.
+      DB_PASSWORD: ci_unit_test_placeholder
+      SECRET_KEY: ci_unit_test_placeholder
     steps:
       - uses: actions/checkout@v4
 
@@ -52,11 +36,8 @@ jobs:
       - name: Ruff lint
         run: ruff check backend/ tests/ alembic/
 
-      - name: Alembic upgrade (smoke)
-        run: alembic upgrade head
-
-      - name: Pytest (unit only)
-        run: pytest tests/ -v
+      - name: Pytest (unit tests only — integration tests run locally)
+        run: pytest tests/ -v -m "not integration"
 
   frontend-build:
     runs-on: python-ci