feat: add Tekton Pipelines for integration testing

Implement Kubernetes-native CI/CD with Tekton Pipelines:

ARCHITECTURE:
- Tekton Task: Runs integration tests in container
- Tekton Pipeline: Orchestrates test execution
- ArgoCD Application: Manages Tekton installation
- CI: Triggers PipelineRun, reads results, promotes image

FLOW:
1. CI builds image:sha
2. CI creates PipelineRun with new image
3. Tekton controller watches PipelineRun
4. Task executes integration tests
5. Results written to PipelineRun status
6. CI reads status, promotes to :latest if pass
7. ArgoCD detects :latest change and deploys

BENEFITS:
✓ Kubernetes-native (CRDs, no external dependencies)
✓ DRY (parameterized Task/Pipeline)
✓ SOLID (single responsibility, clean interfaces)
✓ GitOps (Tekton managed by ArgoCD)
✓ Observable (logs, status, results)
✓ Secure (non-root, resource limits)

FILES:
- k8s/tekton/task-integration-test.yaml: Task definition
- k8s/tekton/pipeline-integration-test.yaml: Pipeline definition
- k8s/tekton/kustomization.yaml: Kustomize management
- k8s/tekton/README.md: Documentation
- k8s/argocd-apps/tekton.yaml: ArgoCD Application
- .gitea/workflows/ci.yaml: Updated CI to use Tekton

NEXT:
1. Merge PR
2. ArgoCD syncs and installs Tekton
3. First git push triggers PipelineRun
4. Integration tests run in cluster
5. Results feedback to CI

k8s/tekton/README.md

@@ -0,0 +1,130 @@
+# Tekton Integration Testing
+
+Tekton Pipelines for running integration tests on API Gateway changes before merging to main.
+
+## Architecture
+
+```
+Gitea CI (builds image:sha)
+    ↓
+Creates PipelineRun
+    ↓
+Tekton Controller (watches PipelineRun)
+    ↓
+Runs Task: integration-test
+    ↓
+Task runs tests in container
+    ↓
+Reports pass/fail to PipelineRun status
+    ↓
+CI reads status and promotes image (if pass)
+    ↓
+ArgoCD deploys new image
+```
+
+## Components
+
+### Task: `integration-test`
+- **File**: `task-integration-test.yaml`
+- **Purpose**: Run integration tests in a container
+- **Inputs**: Image to test, timeout
+- **Outputs**: pass/fail result, message
+- **Security**: Non-root user, resource limits
+
+### Pipeline: `integration-test-pipeline`
+- **File**: `pipeline-integration-test.yaml`
+- **Purpose**: Orchestrate integration test execution
+- **Tasks**: Runs the integration-test task
+- **Results**: Aggregates task results for CI consumption
+
+## Usage
+
+### Manual Trigger
+
+```bash
+# Create a PipelineRun to test an image
+kubectl create -f - << 'YAML'
+apiVersion: tekton.dev/v1
+kind: PipelineRun
+metadata:
+  name: integration-test-manual
+  namespace: api
+spec:
+  pipelineRef:
+    name: integration-test-pipeline
+  params:
+  - name: image
+    value: forgejo.riotpiao.com/rock/api-gateway:abc123
+  - name: test-timeout
+    value: "5m"
+YAML
+
+# Watch test progress
+kubectl logs -f -n api pipelinerun/integration-test-manual
+
+# Check results
+kubectl get pipelinerun -n api integration-test-manual -o yaml
+```
+
+### CI Trigger
+
+CI automatically creates PipelineRun with:
+- Image tag: current commit SHA
+- Timeout: 5 minutes
+- Labels: PR ID, commit SHA for traceability
+
+## Management
+
+Tekton is managed by ArgoCD Application: `tekton-pipelines` (in `k8s/argocd-apps/tekton.yaml`)
+
+To update:
+1. Edit manifest files
+2. Commit to git
+3. ArgoCD syncs automatically
+
+Do NOT manually apply manifests - let ArgoCD manage everything.
+
+## Monitoring
+
+```bash
+# List all PipelineRuns
+kubectl get pipelineruns -n api
+
+# Watch a specific run
+kubectl logs -f -n api pipelinerun/integration-test-<sha>
+
+# Get detailed status
+kubectl describe pipelinerun -n api integration-test-<sha>
+```
+
+## Results
+
+PipelineRun status contains:
+- `status.conditions[0].reason`: Succeeded | Failed | Unknown
+- `status.taskRuns[*].status.taskResults`: Test outputs
+- Pod logs: Detailed test output
+
+## Best Practices
+
+1. **DRY**: Task and Pipeline are parameterized, reusable
+2. **SOLID**: Single responsibility (Task runs tests, Pipeline orchestrates)
+3. **GitOps**: Everything in git, managed by ArgoCD
+4. **Security**: Non-root containers, resource limits, no hardcoded values
+5. **Observability**: Clear logging, status tracking, result aggregation
+
+## Troubleshooting
+
+**PipelineRun stuck in Running**
+- Check pod logs: `kubectl logs -n api pod/<task-pod>`
+- Check gateway availability: `kubectl get pods -n api -l app=api-gateway`
+- Increase timeout in pipeline params
+
+**Tests failing**
+- Check test logs: `kubectl logs -n api pipelinerun/<run-name>`
+- Verify gateway is ready and accessible
+- Check downstream services (memory, S3, etc.)
+
+**Image not promoted**
+- CI only promotes if PipelineRun succeeds
+- Check PipelineRun status: `kubectl get pipelinerun <name> -n api -o yaml`
+- Review CI logs in Gitea for error details