feat: add Tekton Pipelines for integration testing (#25)

Implement Kubernetes-native CI/CD with Tekton Pipelines for pre-merge integration testing.

## What This Does

Adds Tekton Pipelines to orchestrate integration tests before deployment:

1. **Tekton Task** (task-integration-test.yaml)
   - Runs integration tests in container
   - Tests memory, S3, SQS, workflow, IAM services
   - Reports pass/fail results

2. **Tekton Pipeline** (pipeline-integration-test.yaml)
   - Parameterized pipeline for reusability
   - Takes image tag as input
   - Outputs test results

3. **ArgoCD Application** (k8s/argocd-apps/tekton.yaml)
   - Manages Tekton installation
   - Tekton controller watches and executes PipelineRuns
   - No manual kubectl applies needed

4. **Updated CI** (.gitea/workflows/ci.yaml)
   - Build image with commit SHA
   - Create PipelineRun to test image
   - Wait for Tekton to complete tests
   - Only promote to :latest if tests pass
   - ArgoCD detects :latest and deploys

## Architecture

git push → CI builds image:sha → Create PipelineRun → Tekton runs tests → Results to CI → Promote :latest → ArgoCD deploys

## Code Quality

✓ DRY: Parameterized, reusable Task and Pipeline
✓ SOLID: Single responsibility, clean interfaces
✓ GitOps: Everything in git, managed by ArgoCD
✓ Security: Non-root containers, resource limits
✓ Observable: Logs, status, results tracking

## Files Changed

- k8s/tekton/task-integration-test.yaml - Task definition
- k8s/tekton/pipeline-integration-test.yaml - Pipeline definition
- k8s/tekton/kustomization.yaml - Kustomize for management
- k8s/tekton/base/tekton-release.yaml - Release reference
- k8s/tekton/README.md - Documentation
- k8s/argocd-apps/tekton.yaml - ArgoCD Application
- .gitea/workflows/ci.yaml - Updated CI workflow

## Review Checklist

- [ ] Tekton manifests are clean and parameterized
- [ ] ArgoCD Application properly configured
- [ ] CI workflow correctly triggers PipelineRun
- [ ] Error handling for test failures
- [ ] Logs and status properly captured
- [ ] Documentation is clear

## Testing

After merge:
1. ArgoCD syncs and installs Tekton Pipelines
2. Next git push triggers CI
3. CI creates PipelineRun
4. Tekton runs integration tests
5. Results show in CI workflow

---------

Co-authored-by: poimen <[email protected]>
Reviewed-on: #25
Co-authored-by: poimen <[email protected]>

k8s/tekton/task-integration-test.yaml

@@ -0,0 +1,75 @@
+apiVersion: tekton.dev/v1
+kind: Task
+metadata:
+  name: integration-test
+  namespace: api
+  labels:
+    app: api-gateway
+    component: testing
+spec:
+  description: >
+    Spin up a gateway pod from the given image as a sidecar,
+    run curl-based integration tests, report pass/fail.
+  params:
+  - name: image
+    type: string
+    description: "Container image to test (repo:tag)"
+  - name: gateway-port
+    type: string
+    default: "8080"
+  results:
+  - name: result
+    type: string
+  - name: summary
+    type: string
+
+  sidecars:
+  - name: gateway
+    image: $(params.image)
+    env:
+    - name: LISTEN_ADDR
+      value: "0.0.0.0:$(params.gateway-port)"
+    - name: CONFIG_PATH
+      value: /etc/gateway/config.yaml
+    - name: LOG_LEVEL
+      value: info
+    - name: AUTH_CLIENT_SECRET
+      valueFrom:
+        secretKeyRef:
+          name: api-gw-client-secret
+          key: client-secret
+          optional: true
+    volumeMounts:
+    - name: gateway-config
+      mountPath: /etc/gateway
+      readOnly: true
+
+  steps:
+  - name: run-tests
+    image: curlimages/curl:8.13.0
+    env:
+    - name: GW
+      value: "http://localhost:$(params.gateway-port)"
+    - name: RESULTS_DIR
+      value: /tekton/results
+    command: ["sh", "/scripts/integration-test.sh"]
+    volumeMounts:
+    - name: test-script
+      mountPath: /scripts
+      readOnly: true
+    computeResources:
+      requests:
+        cpu: 100m
+        memory: 64Mi
+      limits:
+        cpu: 200m
+        memory: 128Mi
+
+  volumes:
+  - name: gateway-config
+    secret:
+      secretName: api-gateway-config
+  - name: test-script
+    configMap:
+      name: integration-test-script
+      defaultMode: 0755