Add Forgejo Actions CI/CD, ruff linting, and test foundation

- .forgejo/workflows/ci.yml: fast checks on every push (TS typecheck,
  Python lint via ruff, pytest) — no Docker build, ~30s with cache
- .forgejo/workflows/build.yml: Docker build with registry-side layer
  caching + SSH deploy on main branch pushes only
- pyproject.toml: add ruff to dev deps, configure pytest and ruff rules
- tests/: conftest.py + first unit tests for _safe_filename (no DB needed)
- Makefile: add lint, fmt, typecheck, test, check targets for local use

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Makefile

@@ -1,4 +1,6 @@
-.PHONY: build up down logs health migrate
+.PHONY: build up down logs health migrate lint typecheck test fmt
+
+# --- Docker ---
 
 build:
 	docker compose build
@@ -17,3 +19,20 @@ health:
 
 migrate:
 	docker compose exec app alembic upgrade head
+
+# --- Local dev (requires: pip install -e ".[dev]" and cd frontend && npm ci) ---
+
+lint:
+	ruff check src/
+
+fmt:
+	ruff format src/
+
+typecheck:
+	cd frontend && npx vue-tsc --noEmit
+
+test:
+	pytest tests/ -v
+
+# Run all checks in one shot (mirrors what CI does)
+check: lint typecheck test