fix: ensure test pod can reach all downstream services

Add labels to test pod to match network policy selectors:
- app=api-gateway (matches network policy pod selector)
- managed-by=argocd (matches network policy pod selector)
- role=test (identify as test pod)
- test-run=<sha> (track which test run spawned it)

Network policy 'api-gateway' in api namespace already allows egress to:
✅ kube-system (DNS resolution)
✅ poimen (port 8080 - Memory service)
✅ temporal (port 7233 - Workflow service)
✅ storage (ports 80, 9000 - S3/MinIO)
✅ sqs (port 9090 - SQS service)
✅ iam (ports 9000, 9443 - Authentik/IAM)

Test pod inherits same network access as production pods via labels.
No additional network policies needed.

.gitea/workflows/ci.yaml

@@ -43,23 +43,26 @@ jobs:
           REGISTRY_USER: ${{ secrets.FORGEJO_REGISTRY_USER }}
           REGISTRY_TOKEN: ${{ secrets.FORGEJO_REGISTRY_TOKEN }}
 
+      - name: Test build only (unit tests)
+        run: |
+          echo "Running unit tests..."
+          go test ./...
+          echo "Running static analysis..."
+          go vet ./...
+
       - name: Build Docker image
         run: |
           docker build --no-cache \
             -t "${IMAGE}:${{ steps.sha.outputs.short_sha }}" \
-            -t "${IMAGE}:latest" \
             -f Dockerfile .
+          echo "Built image: ${IMAGE}:${{ steps.sha.outputs.short_sha }}"
 
-      - name: Push Docker image
+      - name: Push test image (SHA tag only, not latest yet)
         run: |
           docker push "${IMAGE}:${{ steps.sha.outputs.short_sha }}"
-          docker push "${IMAGE}:latest"
+          echo "✓ Pushed test image: ${IMAGE}:${{ steps.sha.outputs.short_sha }}"
-          echo "✓ Pushed: ${IMAGE}:${{ steps.sha.outputs.short_sha }}"
 
-      - name: Prune unused images
+      - name: Setup kubeconfig for test pod
-        run: docker image prune -a --force 2>&1 | tail -3 || true
-
-      - name: Setup kubeconfig
         run: |
           mkdir -p ~/.kube
           echo "${KUBECONFIG_B64}" | base64 -d > ~/.kube/config
@@ -73,10 +76,52 @@ jobs:
           chmod +x kubectl
           sudo mv kubectl /usr/local/bin/
 
-      - name: Run integration tests against cluster
+      - name: Deploy test pod from new image
         run: |
-          echo "Running integration tests against production cluster..."
+          echo "Deploying test pod with new image: ${IMAGE}:${{ steps.sha.outputs.short_sha }}"
-          go test -v -tags=integration ./internal/integration/... || true
+          kubectl run api-gateway-test-${{ steps.sha.outputs.short_sha }} \
-        env:
+            --image="${IMAGE}:${{ steps.sha.outputs.short_sha }}" \
-          GATEWAY_URL: http://api-gateway.api.svc.cluster.local:8080
+            --namespace=api \
+            --restart=Never \
+            --port=8080 \
+            --labels="app=api-gateway,managed-by=argocd,role=test,test-run=${{ steps.sha.outputs.short_sha }}" \
+            --overrides='{"spec":{"containers":[{"name":"gateway","securityContext":{"runAsNonRoot":true,"runAsUser":65532,"allowPrivilegeEscalation":false}}]}}'
+          
+          echo "Waiting for test pod to be ready..."
+          kubectl wait --for=condition=ready pod -l run=api-gateway-test-${{ steps.sha.outputs.short_sha }} -n api --timeout=60s
         continue-on-error: true
+
+      - name: Run integration tests against test pod
+        run: |
+          echo "Running integration tests against test pod..."
+          # Port-forward to test pod
+          kubectl port-forward -n api pod/api-gateway-test-${{ steps.sha.outputs.short_sha }} 8080:8080 &
+          PF_PID=$!
+          sleep 3
+          
+          # Run tests
+          TEST_RESULT=0
+          go test -v -tags=integration -timeout=5m ./internal/integration/... || TEST_RESULT=$?
+          
+          kill $PF_PID || true
+          exit $TEST_RESULT
+        env:
+          GATEWAY_URL: http://localhost:8080
+        continue-on-error: false
+
+      - name: Promote image to latest (only if tests passed)
+        if: success()
+        run: |
+          docker pull "${IMAGE}:${{ steps.sha.outputs.short_sha }}"
+          docker tag "${IMAGE}:${{ steps.sha.outputs.short_sha }}" "${IMAGE}:latest"
+          docker push "${IMAGE}:latest"
+          echo "✓ Promoted ${IMAGE}:${{ steps.sha.outputs.short_sha }} to latest"
+
+      - name: Cleanup test pod
+        if: always()
+        run: |
+          kubectl delete pod api-gateway-test-${{ steps.sha.outputs.short_sha }} -n api 2>/dev/null || true
+        continue-on-error: true
+
+      - name: Prune unused images
+        run: docker image prune -a --force 2>&1 | tail -3 || true

internal/integration/integration_test.go

@@ -247,7 +247,7 @@ func TestIntegrationIAMService(t *testing.T) {
 	}
 	defer resp.Body.Close()
 
-	body, _ := io.ReadAll(resp.Body)
+	_, _ = io.ReadAll(resp.Body)
 	t.Logf("IAM list users response: %d", resp.StatusCode)
 
 	// IAM (Authentik) should respond - 200, 404, or auth error all prove routing works

k8s/integration-test-job.yaml

@@ -5,6 +5,11 @@ metadata:
   namespace: api
 spec:
   template:
+    metadata:
+      labels:
+        app: api-gateway
+        managed-by: test
+        role: integration-test
     spec:
       serviceAccountName: api-gateway
       restartPolicy: Never