feat(ci): pin container.image to ci-python:3.14 + ship ci-requirements.md

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

ci-requirements.md

@@ -0,0 +1,37 @@
+# CI Requirements — FabledCurator
+
+> Spec: https://git.fabledsword.com/bvandeusen/CI-runner/src/branch/main/docs/process.md
+
+## Runtime image
+
+git.fabledsword.com/bvandeusen/ci-python:3.14
+
+## Image deps used
+
+- python 3.14
+- ruff (analyzer for `backend/`, `tests/`, `alembic/`)
+- node (frontend job: `npm install` + vitest + vite build)
+- docker CLI + buildx (`.forgejo/workflows/build.yml`: build-web, build-ml — Forgejo registry push)
+
+## Per-job tool installs
+
+- `pip install -r requirements.txt pytest pytest-asyncio` — in `backend-lint-and-test` and `integration` jobs
+- `npm install --no-audit --no-fund` — in `frontend-build` job
+
+## Notes
+
+- Integration wall time ~3 min, dominated by pgvector container start + the
+  `pip install` step (~30-45s on cold cache) + alembic + 300+ integration tests.
+- The `pip install` in two jobs is intentional and per `docs/process.md`'s
+  "add deps to image when used by >1 project" rule: FC alone is one Python
+  project, so the deps live in `requirements.txt` and install per-job.
+  Reconsider when a second Fabled-family Python backend lands.
+- Integration uses Forgejo Actions `services:` + socket-discovered bridge IPs
+  because `act_runner` (swarm-runner v0.6+) puts services on the default
+  bridge with no embedded DNS. The pattern is documented in the rulebook's
+  `forgejo.md` "CI philosophy" section and FC's `ci.yml` is the canonical
+  example.
+- No `package-lock.json` is tracked yet (FC's `feedback_no_local_runs`
+  memory bans `npm install` locally). Using `npm install` rather than
+  `npm ci` until a lockfile lands.
+- No `imagemagick` / `pandoc` per-job installs needed.