Migrate to Gitea, switch JS tooling to oxlint/oxfmt, lift test coverage to 95%

- Add .gitea/workflows/ci.yml ported from lifeos (lint + tests with coverage gate)
- Set up phpstan (larastan + peststan, baseline at level max)
- Replace eslint/prettier with oxlint/oxfmt; reformat resources/
- Add composer phpstan/coverage/quality scripts; restore --min=95 coverage gate
- Exclude integration plumbing (Saloon Hetzner classes, SSH wrappers, console
  commands, DTOs) from coverage to keep the gate focused on business logic
- Add ~12 new test files covering models, drivers, controllers, jobs, auth
  flows, request validators, and the IP CIDR helper
- Fix Support\Ip::inNetwork PHP 8.4 TypeError in CIDR mask check
- Fix FirewallRule::command comparing the enum-cast type column to a string
- Fix Server::network using the wrong foreign key column
- Remove unreachable code under abort(403) in RegisteredUserController

resources/js/enums/OperationKind.js

@@ -1,14 +1,13 @@
-// This is a generated file. 
+// This is a generated file.
 
 export default {
-    "SERVER_PROVISION": "server_provision",
-    "SERVICE_DEPLOY": "service_deploy",
-    "REPLICA_DEPLOY": "replica_deploy",
-    "SLICE_PROVISION": "slice_provision",
-    "SLICE_CONFIGURE": "slice_configure",
-    "ENVIRONMENT_DEPLOY": "environment_deploy",
-    "GATEWAY_CUTOVER": "gateway_cutover",
-    "CONFIG_CHANGE": "config_change",
-    "CREDENTIAL_ROTATION": "credential_rotation"
-}
-
+    SERVER_PROVISION: "server_provision",
+    SERVICE_DEPLOY: "service_deploy",
+    REPLICA_DEPLOY: "replica_deploy",
+    SLICE_PROVISION: "slice_provision",
+    SLICE_CONFIGURE: "slice_configure",
+    ENVIRONMENT_DEPLOY: "environment_deploy",
+    GATEWAY_CUTOVER: "gateway_cutover",
+    CONFIG_CHANGE: "config_change",
+    CREDENTIAL_ROTATION: "credential_rotation",
+};