Covers secrets encryption, Nixpacks runtime-version detection, the
admin-session middleware, and the installations state machine. CI
runs the same build+test steps on every push via .gitea/workflows/ci.yml.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
