feat: Tekton-based integration testing (proper K8s CI/CD)

Replace ad-hoc K8s Job with proper Tekton TaskRun:

k8s/tekton/integration-test-task.yaml:
  - Tekton Task for integration testing
  - Two stages: migrate + test
  - Runs existing Rust integration tests:
    * it_phase3_phase4 (ingest + persistence)
    * it_unified_query_4_6 (query endpoint)
    * it_temporal_filtering_4_2_fixed (temporal)
    * mem_ingest (extraction pipeline)
    * mem_cli::query (query handler)
  - Reports results to /tekton/results/summary
  - Resource limits: 1Gi mem, 500m CPU

.gitea/workflows/build.yaml:
  - Integrated Tekton trigger after image push
  - Create TaskRun with image SHA
  - Wait for completion (5m timeout)
  - Gate image promotion on test passing
  - Only promote to :latest if tests pass

Pattern (from homelab-frontend):
  1. Build image → push with SHA
  2. Trigger Tekton TaskRun
  3. Wait for result
  4. Gate promotion
  5. Promote to :latest only if tests pass

Benefits:
  ✓ Proper K8s CI/CD framework
  ✓ Reusable Task
  ✓ Better logging/results
  ✓ Proper resource mgmt
  ✓ Matches homelab pattern

Requires:
  - Tekton Pipelines installed in cluster
  - KUBECONFIG_B64 secret in Forgejo

k8s/tekton/integration-test-task.yaml

@@ -0,0 +1,150 @@
+---
+# Tekton Task: Integration Tests for Poimen Memory Service
+#
+# Executes:
+#   1. Database migrations
+#   2. Integration test suites (cargo test)
+#   3. Reports results
+#
+# Parameters:
+#   - image: Docker image with SHA to test
+#
+# Results:
+#   - summary: Test summary (pass/fail + count)
+
+apiVersion: tekton.dev/v1
+kind: Task
+metadata:
+  name: poimen-integration-test
+  namespace: poimen
+spec:
+  params:
+  - name: image
+    type: string
+    description: "Docker image SHA to test (e.g., forgejo.riotpiao.com/riotpiao-poimen/poimen-memory:abc123)"
+
+  results:
+  - name: summary
+    description: "Test summary: PASS or FAIL + test count"
+
+  steps:
+  # Step 1: Apply database migrations
+  - name: migrate
+    image: $(params.image)
+    env:
+    - name: DB_HOST
+      value: "memory-db-rw.poimen.svc.cluster.local"
+    - name: DB_PORT
+      value: "5432"
+    - name: DB_NAME
+      value: "memory"
+    - name: DB_USER
+      value: "app"
+    - name: DB_PASSWORD
+      valueFrom:
+        secretKeyRef:
+          name: memory-db-app
+          key: password
+    
+    script: |
+      #!/bin/bash
+      set -e
+      
+      echo "=========================================="
+      echo "Step 1: Database Migrations"
+      echo "=========================================="
+      echo ""
+      
+      # Run migrations
+      /app/migrations/run_migrations.sh
+      
+      echo ""
+      echo "✓ Migrations complete"
+
+  # Step 2: Run integration tests
+  - name: test
+    image: $(params.image)
+    env:
+    - name: DATABASE_URL
+      value: "postgresql://[email protected]:5432/memory"
+    - name: RUST_LOG
+      value: "info,mem_cli=debug,mem_ingest=debug,mem_store=debug"
+    - name: MEM_AUTH_MODE
+      value: "none"
+    - name: SQLX_OFFLINE
+      value: "true"
+    - name: PGPASSWORD
+      valueFrom:
+        secretKeyRef:
+          name: memory-db-app
+          key: password
+    
+    script: |
+      #!/bin/bash
+      set -e
+      
+      echo "=========================================="
+      echo "Step 2: Integration Tests"
+      echo "=========================================="
+      echo ""
+      
+      TEST_SUITES=(
+        "it_phase3_phase4"
+        "it_unified_query_4_6"
+        "it_temporal_filtering_4_2_fixed"
+      )
+      
+      PASSED=0
+      FAILED=0
+      
+      for suite in "${TEST_SUITES[@]}"; do
+        echo "Running: $suite"
+        if cargo test --test "$suite" --lib 2>&1 | tail -50; then
+          ((PASSED++))
+          echo "✓ $suite passed"
+        else
+          ((FAILED++))
+          echo "✗ $suite failed"
+        fi
+        echo ""
+      done
+      
+      # Run unit tests
+      echo "Running unit tests..."
+      if cargo test --lib mem_ingest 2>&1 | tail -100; then
+        echo "✓ mem_ingest passed"
+      else
+        ((FAILED++))
+        echo "✗ mem_ingest failed"
+      fi
+      echo ""
+      
+      if cargo test --lib mem_cli::query 2>&1 | tail -100; then
+        echo "✓ mem_cli::query passed"
+      else
+        ((FAILED++))
+        echo "✗ mem_cli::query failed"
+      fi
+      
+      echo ""
+      echo "=========================================="
+      echo "Test Summary: $PASSED passed, $FAILED failed"
+      echo "=========================================="
+      
+      if [ $FAILED -eq 0 ]; then
+        echo "PASS: All integration tests passed"
+        echo "PASS: All integration tests passed" > /tekton/results/summary
+        exit 0
+      else
+        echo "FAIL: $FAILED test suite(s) failed"
+        echo "FAIL: $FAILED test suite(s) failed" > /tekton/results/summary
+        exit 1
+      fi
+
+  resources:
+    requests:
+      memory: "1Gi"
+      cpu: "500m"
+    limits:
+      memory: "2Gi"
+      cpu: "2000m"