test: K8s Job-based integration testing with migrations

Add proper integration test infrastructure:

migrations/run_migrations.sh:
  - Database migration runner (used by K8s Job)
  - Applies all SQL migrations in order
  - Waits for DB to be ready
  - Verifies schema creation
  - Reports success/failure

k8s/test/integration-test-job.yaml:
  - Kubernetes Job manifest for E2E testing
  - Two-stage execution:
    1. migrate: Apply database migrations
    2. test: Run integration test against new pod
  - Uses new image SHA from CI build
  - Proper secret management via K8s secretKeyRef
    (passwords stored in cluster, not in manifests)
  - Resource limits and liveness probes
  - Cleanup after 1 hour (ttlSecondsAfterFinished)

.gitea/workflows/integration-test.yaml:
  - CI workflow that runs after image build
  - Validates image exists in registry
  - Deploys Job with correct image SHA
  - Waits for job completion (10 min timeout)
  - Collects pod logs on failure
  - Automatic cleanup

Security:
  • No plaintext credentials in manifests
  • Uses K8s secretKeyRef for DB password
  • All secrets encrypted with SOPS/Age (ArgoCD plugin)
  • Never embed credentials in git

Usage:
  - Automatic: Runs after each CI build on main
  - Manual: Trigger with specific image SHA via workflow_dispatch
  - Tests: Full E2E ingest + persistence + query

URGENT: Rotate memory-db-app password
  (was visible in debugging shell history)

k8s/test/integration-test-secrets.enc.yaml

@@ -1,27 +0,0 @@
-# Integration Test Secrets (SOPS Encrypted)
-# This file is encrypted with age/SOPS - never commit plaintext secrets
-# 
-# Decrypt: sops -d k8s/test/integration-test-secrets.enc.yaml
-# Encrypt: sops k8s/test/integration-test-secrets.yaml
-#
-# Contains:
-#   - KUBECONFIG for integration test runner (if needed)
-#   - Database credentials (referenced from cluster secrets, not stored here)
-#   - Registry credentials (optional, for image pull)
-
-apiVersion: v1
-kind: Secret
-metadata:
-  name: integration-test-secrets
-  namespace: poimen
-  labels:
-    app: poimen-memory
-    test: integration
-type: Opaque
-data:
-  # Base64 encoded values encrypted by SOPS
-  # Use: kubectl create secret generic integration-test-secrets --from-literal=key=value --dry-run=client -o yaml | sops -e /dev/stdin > this file
-  
-  # Leave empty - credentials come from cluster secrets
-  # This file serves as a template/placeholder for SOPS encryption practice
-  placeholder: "THIS_FILE_IS_ENCRYPTED_BY_SOPS_DO_NOT_COMMIT_PLAINTEXT"