Covers secrets encryption, Nixpacks runtime-version detection, the admin-session middleware, and the installations state machine. CI runs the same build+test steps on every push via .gitea/workflows/ci.yml. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>