feat(08-02): ci.yml api job with mariadb service

- api job: runs-on ubuntu-latest, if pull_request, parallel with fast-checks (no needs:)
- services: mariadb:11 with healthcheck.sh --connect --innodb_initialized options
  (--health-start-period=30s for MariaDB 11 InnoDB cold-start, --health-retries=10)
- DB_HOST: mariadb (Docker-executor confirmed by D-PROBE-02)
- Throwaway creds: familysync/testpass scoped to ephemeral service container (T-08-03)
- No actions/cache (D-PROBE-04)
- Node mysql2 readiness poll via --input-type=commonjs inline script, 90s deadline
  (no mysql CLI in runner image per D-PROBE-03; Pitfall 11 belt-and-suspenders)
- db:migrate (drizzle-kit migrate); drizzle push never used (T-08-04, MariaDB unsafe)
- pnpm --filter @familysync/api test: full DB-backed API test suite

.gitea/workflows/ci.yml

@@ -41,3 +41,89 @@ jobs:
 
       - name: PWA unit tests
         run: pnpm --filter @familysync/pwa test
+
+  api:
+    runs-on: ubuntu-latest
+    if: github.event_name == 'pull_request'
+    # Runs in PARALLEL with fast-checks (D-03) — no needs: dependency.
+    services:
+      mariadb:
+        image: mariadb:11
+        env:
+          MARIADB_ROOT_PASSWORD: root
+          MARIADB_DATABASE: familysync
+          MARIADB_USER: familysync
+          MARIADB_PASSWORD: testpass
+        options: >-
+          --health-cmd="healthcheck.sh --connect --innodb_initialized"
+          --health-interval=10s
+          --health-timeout=5s
+          --health-retries=10
+          --health-start-period=30s
+    # Throwaway creds scoped to the ephemeral service container — never production secrets (T-08-03).
+    env:
+      DB_HOST: mariadb
+      DB_PORT: 3306
+      DB_USER: familysync
+      DB_PASSWORD: testpass
+      DB_NAME: familysync
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '22'
+
+      - name: Enable pnpm
+        run: corepack enable pnpm
+
+      # actions/cache@v4 intentionally omitted — same reasoning as fast-checks job (D-PROBE-04).
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+
+      # Pitfall 11: service container healthy != MariaDB accepting connections.
+      # No mysql CLI in the runner image (D-PROBE-03); poll via the already-installed
+      # mysql2 driver using an inline Node script. 90s deadline covers cold-start InnoDB init.
+      - name: Wait for MariaDB to accept connections
+        # No mysql CLI in the runner image (D-PROBE-03). Poll via the mysql2 driver
+        # already installed in apps/pwa (devDependency). --input-type=commonjs forces
+        # CJS mode even though apps/pwa has "type":"module" in its package.json.
+        run: |
+          node --input-type=commonjs - <<'EOF'
+          const mysql = require('mysql2/promise');
+          const deadline = Date.now() + 90_000;
+          (async () => {
+            while (true) {
+              try {
+                const conn = await mysql.createConnection({
+                  host: process.env.DB_HOST,
+                  port: Number(process.env.DB_PORT ?? 3306),
+                  user: process.env.DB_USER,
+                  password: process.env.DB_PASSWORD,
+                  database: process.env.DB_NAME,
+                });
+                await conn.query('SELECT 1');
+                await conn.end();
+                console.log('MariaDB ready');
+                process.exit(0);
+              } catch (err) {
+                if (Date.now() >= deadline) {
+                  console.error('MariaDB did not become ready within 90s:', err.message);
+                  process.exit(1);
+                }
+                await new Promise(r => setTimeout(r, 3000));
+              }
+            }
+          })();
+          EOF
+        working-directory: apps/pwa
+
+      # Apply schema migrations. Uses drizzle-kit migrate (applies committed SQL files).
+      # Never use drizzle push — unsafe on MariaDB (emits destructive TRUNCATE diff, T-08-04).
+      - name: Run DB migrations
+        run: pnpm --filter @familysync/api db:migrate
+
+      # Full DB-backed API test suite (all tests in apps/api/tests/ require a real MariaDB).
+      - name: Run API tests
+        run: pnpm --filter @familysync/api test