Add Forgejo Actions CI/CD, ruff linting, and test foundation

- .forgejo/workflows/ci.yml: fast checks on every push (TS typecheck,
  Python lint via ruff, pytest) — no Docker build, ~30s with cache
- .forgejo/workflows/build.yml: Docker build with registry-side layer
  caching + SSH deploy on main branch pushes only
- pyproject.toml: add ruff to dev deps, configure pytest and ruff rules
- tests/: conftest.py + first unit tests for _safe_filename (no DB needed)
- Makefile: add lint, fmt, typecheck, test, check targets for local use

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

tests/conftest.py

@@ -0,0 +1,19 @@
+"""
+Shared pytest fixtures.
+
+Integration tests that need a real database should use a separate PostgreSQL
+instance (e.g. a Docker service spun up by the CI job) and set DATABASE_URL
+in the environment before importing the app.
+
+For unit tests of pure functions no database is needed at all.
+"""
+import os
+import pytest
+
+
+@pytest.fixture(autouse=True)
+def _isolate_env(monkeypatch):
+    """Prevent tests from accidentally reading production env vars."""
+    monkeypatch.setenv("DATABASE_URL", "postgresql+asyncpg://test:test@localhost/test")
+    monkeypatch.setenv("SECRET_KEY", "test-secret-key")
+    monkeypatch.setenv("OLLAMA_URL", "http://localhost:11434")