feat: add Tekton Pipelines for integration testing (#25)

Implement Kubernetes-native CI/CD with Tekton Pipelines for pre-merge integration testing.

## What This Does

Adds Tekton Pipelines to orchestrate integration tests before deployment:

1. **Tekton Task** (task-integration-test.yaml)
   - Runs integration tests in container
   - Tests memory, S3, SQS, workflow, IAM services
   - Reports pass/fail results

2. **Tekton Pipeline** (pipeline-integration-test.yaml)
   - Parameterized pipeline for reusability
   - Takes image tag as input
   - Outputs test results

3. **ArgoCD Application** (k8s/argocd-apps/tekton.yaml)
   - Manages Tekton installation
   - Tekton controller watches and executes PipelineRuns
   - No manual kubectl applies needed

4. **Updated CI** (.gitea/workflows/ci.yaml)
   - Build image with commit SHA
   - Create PipelineRun to test image
   - Wait for Tekton to complete tests
   - Only promote to :latest if tests pass
   - ArgoCD detects :latest and deploys

## Architecture

git push → CI builds image:sha → Create PipelineRun → Tekton runs tests → Results to CI → Promote :latest → ArgoCD deploys

## Code Quality

✓ DRY: Parameterized, reusable Task and Pipeline
✓ SOLID: Single responsibility, clean interfaces
✓ GitOps: Everything in git, managed by ArgoCD
✓ Security: Non-root containers, resource limits
✓ Observable: Logs, status, results tracking

## Files Changed

- k8s/tekton/task-integration-test.yaml - Task definition
- k8s/tekton/pipeline-integration-test.yaml - Pipeline definition
- k8s/tekton/kustomization.yaml - Kustomize for management
- k8s/tekton/base/tekton-release.yaml - Release reference
- k8s/tekton/README.md - Documentation
- k8s/argocd-apps/tekton.yaml - ArgoCD Application
- .gitea/workflows/ci.yaml - Updated CI workflow

## Review Checklist

- [ ] Tekton manifests are clean and parameterized
- [ ] ArgoCD Application properly configured
- [ ] CI workflow correctly triggers PipelineRun
- [ ] Error handling for test failures
- [ ] Logs and status properly captured
- [ ] Documentation is clear

## Testing

After merge:
1. ArgoCD syncs and installs Tekton Pipelines
2. Next git push triggers CI
3. CI creates PipelineRun
4. Tekton runs integration tests
5. Results show in CI workflow

---------

Co-authored-by: poimen <[email protected]>
Reviewed-on: #25
Co-authored-by: poimen <[email protected]>

k8s/tekton/scripts/integration-test.sh

@@ -0,0 +1,94 @@
+#!/bin/sh
+set -e
+
+# Integration test runner for API gateway.
+# Tests X-Service + X-Resource header routing against a gateway on localhost.
+#
+# Required env:
+#   GW           — gateway base URL (e.g. http://localhost:8080)
+#   RESULTS_DIR  — directory to write Tekton results
+
+PASS=0; FAIL=0; TOTAL=0
+
+assert() {
+  NAME="$1"; EXPECT="$2"
+  shift 2
+  TOTAL=$((TOTAL + 1))
+  CODE=$(curl -s -o /dev/null -w '%{http_code}' "$@" 2>/dev/null || echo "000")
+
+  if [ "$CODE" = "$EXPECT" ]; then
+    echo "  ✓ ${NAME} (${CODE})"
+    PASS=$((PASS + 1))
+  else
+    echo "  ✗ ${NAME} — expected ${EXPECT}, got ${CODE}"
+    FAIL=$((FAIL + 1))
+  fi
+}
+
+# ── Wait for sidecar gateway ──
+echo "⏳ Waiting for gateway sidecar..."
+READY=false
+for i in $(seq 1 60); do
+  CODE=$(curl -s -o /dev/null -w '%{http_code}' "${GW}/healthz" 2>/dev/null || echo "000")
+  if [ "$CODE" = "200" ]; then
+    sleep 1
+    C2=$(curl -s -o /dev/null -w '%{http_code}' "${GW}/healthz" 2>/dev/null || echo "000")
+    C3=$(curl -s -o /dev/null -w '%{http_code}' "${GW}/healthz" 2>/dev/null || echo "000")
+    if [ "$C2" = "200" ] && [ "$C3" = "200" ]; then
+      READY=true
+      echo "✓ Gateway ready"
+      break
+    fi
+  fi
+  sleep 2
+done
+
+if [ "$READY" = "false" ]; then
+  echo "✗ Gateway never became ready"
+  echo "fail" > "${RESULTS_DIR}/result"
+  echo "0/0 gateway timeout" > "${RESULTS_DIR}/summary"
+  exit 1
+fi
+
+echo ""
+echo "═══ Integration Tests ═══"
+echo ""
+
+# ── Health ──
+echo "▸ Health"
+assert "GET /healthz" 200  -X GET "${GW}/healthz"
+assert "GET /readyz"  200  -X GET "${GW}/readyz"
+
+# ── Header validation ──
+echo "▸ Header validation"
+assert "X-Service without X-Resource → 400" 400 \
+  -X GET -H "X-Service: memory" "${GW}/"
+assert "unknown service → 404" 404 \
+  -X GET -H "X-Service: nonexistent" -H "X-Resource: foo" "${GW}/"
+
+# ── S3 (no auth, MinIO rejects → 403) ──
+echo "▸ S3 service"
+assert "s3/list-objects" 403 \
+  -X GET -H "X-Service: s3" -H "X-Resource: list-objects" "${GW}/"
+
+# ── SQS (auth required → 401) ──
+echo "▸ SQS service"
+assert "sqs/list-queues" 401 \
+  -X GET -H "X-Service: sqs" -H "X-Resource: list-queues" "${GW}/"
+
+# ── Workflow (gRPC needs content-type → 400) ──
+echo "▸ Workflow service"
+assert "workflow/list (no grpc content-type → 400)" 400 \
+  -X GET -H "X-Service: workflow" -H "X-Resource: list" "${GW}/"
+
+echo ""
+echo "═══ Results: ${PASS}/${TOTAL} passed, ${FAIL} failed ═══"
+
+if [ "$FAIL" -eq 0 ]; then
+  echo "pass" > "${RESULTS_DIR}/result"
+else
+  echo "fail" > "${RESULTS_DIR}/result"
+fi
+echo "${PASS}/${TOTAL} passed, ${FAIL} failed" > "${RESULTS_DIR}/summary"
+
+[ "$FAIL" -eq 0 ]