test: add vitest unit tests and Gitea Actions CI workflow

Covers secrets encryption, Nixpacks runtime-version detection, the
admin-session middleware, and the installations state machine. CI
runs the same build+test steps on every push via .gitea/workflows/ci.yml.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

apps/server/src/crypto/secrets.test.ts

@@ -0,0 +1,25 @@
+import { describe, expect, it, beforeAll } from "vitest";
+import { encryptSecret, decryptSecret, generateBearerToken } from "./secrets.js";
+
+beforeAll(() => {
+  process.env.MASTER_KEY = "test-master-key-at-least-32-characters-long";
+});
+
+describe("secrets", () => {
+  it("round-trips an encrypted value", () => {
+    const encrypted = encryptSecret("hello world");
+    expect(encrypted).not.toContain("hello world");
+    expect(decryptSecret(encrypted)).toBe("hello world");
+  });
+
+  it("fails to decrypt with a tampered ciphertext", () => {
+    const encrypted = encryptSecret("hello world");
+    const tampered = Buffer.from(encrypted, "base64");
+    tampered[tampered.length - 1] ^= 0xff;
+    expect(() => decryptSecret(tampered.toString("base64"))).toThrow();
+  });
+
+  it("generates distinct bearer tokens", () => {
+    expect(generateBearerToken()).not.toBe(generateBearerToken());
+  });
+});