feat(08-03): add harness job — DB + migrate + API background + :3000 readiness

- Add harness job to ci.yml (ubuntu-latest, pull_request, parallel with fast-checks + api)
- MariaDB 11 service container with healthcheck.sh readiness (same pattern as api job)
- mysql2 readiness poll (no mysql CLI in runner image, D-PROBE-03)
- db:migrate via drizzle-kit (never db:push, T-08-07)
- pnpm --filter @familysync/api build before starting (Pitfall 4)
- API background: DEV_AUTH_BYPASS=true inline on node line (Pitfall 8), NODE_ENV=development
- curl retry loop on localhost:3000/health, 60s deadline, kill+exit on timeout (D-02/T-08-08)

.gitea/workflows/ci.yml

@@ -127,3 +127,155 @@ jobs:
       # Full DB-backed API test suite (all tests in apps/api/tests/ require a real MariaDB).
       - name: Run API tests
         run: pnpm --filter @familysync/api test
+
+  harness:
+    runs-on: ubuntu-latest
+    if: github.event_name == 'pull_request'
+    # Runs in PARALLEL with fast-checks + api (D-03) — no needs: dependency.
+    services:
+      mariadb:
+        image: mariadb:11
+        env:
+          MARIADB_ROOT_PASSWORD: root
+          MARIADB_DATABASE: familysync
+          MARIADB_USER: familysync
+          MARIADB_PASSWORD: testpass
+        options: >-
+          --health-cmd="healthcheck.sh --connect --innodb_initialized"
+          --health-interval=10s
+          --health-timeout=5s
+          --health-retries=10
+          --health-start-period=30s
+    # Throwaway creds scoped to the ephemeral service container — never production secrets (T-08-06).
+    env:
+      DB_HOST: mariadb
+      DB_PORT: 3306
+      DB_USER: familysync
+      DB_PASSWORD: testpass
+      DB_NAME: familysync
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '22'
+
+      - name: Enable pnpm
+        run: corepack enable pnpm
+
+      # actions/cache@v4 intentionally omitted — same reasoning as fast-checks job (D-PROBE-04).
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+
+      # Pitfall 11: service container healthy != MariaDB accepting connections.
+      # No mysql CLI in the runner image (D-PROBE-03); poll via the mysql2 driver
+      # already installed in apps/pwa (devDependency). --input-type=commonjs forces
+      # CJS mode even though apps/pwa has "type":"module" in its package.json.
+      - name: Wait for MariaDB to accept connections
+        run: |
+          node --input-type=commonjs - <<'EOF'
+          const mysql = require('mysql2/promise');
+          const deadline = Date.now() + 90_000;
+          (async () => {
+            while (true) {
+              try {
+                const conn = await mysql.createConnection({
+                  host: process.env.DB_HOST,
+                  port: Number(process.env.DB_PORT ?? 3306),
+                  user: process.env.DB_USER,
+                  password: process.env.DB_PASSWORD,
+                  database: process.env.DB_NAME,
+                });
+                await conn.query('SELECT 1');
+                await conn.end();
+                console.log('MariaDB ready');
+                process.exit(0);
+              } catch (err) {
+                if (Date.now() >= deadline) {
+                  console.error('MariaDB did not become ready within 90s:', err.message);
+                  process.exit(1);
+                }
+                await new Promise(r => setTimeout(r, 3000));
+              }
+            }
+          })();
+          EOF
+        working-directory: apps/pwa
+
+      # Apply schema migrations. Uses drizzle-kit migrate (applies committed SQL files).
+      # Never use drizzle push — unsafe on MariaDB (emits destructive TRUNCATE diff, T-08-07).
+      - name: Run DB migrations
+        run: pnpm --filter @familysync/api db:migrate
+
+      # Build the API before starting it — dist/ is gitignored and does not exist in CI (Pitfall 4).
+      - name: Build API
+        run: pnpm --filter @familysync/api build
+
+      # Start the API as a background process.
+      # DEV_AUTH_BYPASS=true is passed INLINE on the node line (Pitfall 8 — env inheritance
+      # across & steps is not guaranteed in all runner modes). NODE_ENV=development is required:
+      # global-setup.ts refuses NODE_ENV=production, and the API devBypass.ts checks development.
+      - name: Start API background process
+        run: |
+          NODE_ENV=development DEV_AUTH_BYPASS=true DB_HOST=$DB_HOST DB_PORT=3306 DB_USER=familysync DB_PASSWORD=testpass DB_NAME=familysync node apps/api/dist/index.js &
+          echo $! > /tmp/api.pid
+          echo "API PID: $(cat /tmp/api.pid)"
+
+      # Wait for the API :3000/health before Playwright starts (D-02 / T-08-08).
+      # This step-level wait is SEPARATE from global-setup.ts's poll — global-setup runs AFTER
+      # Playwright starts and polls through the Vite proxy. The step-level wait ensures the API
+      # is up before Playwright even attempts to start Vite. ~60s deadline.
+      - name: Wait for API (:3000/health)
+        run: |
+          deadline=$((SECONDS + 60))
+          until curl -sf http://localhost:3000/health > /dev/null 2>&1; do
+            if [ $SECONDS -ge $deadline ]; then
+              echo "API did not start within 60s"
+              kill $(cat /tmp/api.pid) 2>/dev/null || true
+              exit 1
+            fi
+            sleep 2
+          done
+          echo "API ready at :3000"
+
+      # Install Playwright browsers with system deps.
+      # Must run from apps/pwa/ where @playwright/test is installed (D-PROBE-05 confirmed exit 0).
+      # Do NOT cache browser binaries — Playwright explicitly recommends against it in CI.
+      - name: Install Playwright browsers
+        run: npx playwright install --with-deps webkit chromium
+        working-directory: apps/pwa
+
+      # Run the Phase 7 Playwright harness across both device profiles (iphone + pixel).
+      # CI=true makes Playwright: start Vite :5173 itself (reuseExistingServer=false),
+      # use retries:2/workers:1, and apply reporter:'github' from config — which we
+      # override with --reporter=list,html because Gitea does not render github annotations
+      # (Pitfall 5 / D-06). Both projects run by default (no --project filter).
+      - name: Run Playwright harness (iphone + pixel)
+        run: pnpm test:e2e -- --reporter=list,html
+        env:
+          CI: 'true'
+          PLAYWRIGHT_BASE_URL: http://localhost:5173
+          DEV_AUTH_BYPASS: 'true'
+          NODE_ENV: development
+          DB_HOST: mariadb
+          DB_PORT: 3306
+          DB_USER: familysync
+          DB_PASSWORD: testpass
+          DB_NAME: familysync
+
+      # Upload traces/screenshots/videos on failure for debugging (D-06).
+      # MUST use ChristopherHX/gitea-upload-artifact@v4 — actions/upload-artifact@v4 detects
+      # Gitea as GHES and aborts (Pitfall 6 / D-PROBE-06).
+      - name: Upload Playwright test artifacts
+        if: failure()
+        uses: https://github.com/ChristopherHX/gitea-upload-artifact@v4
+        with:
+          name: playwright-traces-${{ github.run_id }}
+          path: apps/pwa/test-results/
+          retention-days: 14
+
+      # Always kill the API background process to clean up, even on success.
+      - name: Kill API background process
+        if: always()
+        run: kill $(cat /tmp/api.pid) 2>/dev/null || true