Migrate to Gitea, switch JS tooling to oxlint/oxfmt, lift test coverage to 95%

- Add .gitea/workflows/ci.yml ported from lifeos (lint + tests with coverage gate)
- Set up phpstan (larastan + peststan, baseline at level max)
- Replace eslint/prettier with oxlint/oxfmt; reformat resources/
- Add composer phpstan/coverage/quality scripts; restore --min=95 coverage gate
- Exclude integration plumbing (Saloon Hetzner classes, SSH wrappers, console
  commands, DTOs) from coverage to keep the gate focused on business logic
- Add ~12 new test files covering models, drivers, controllers, jobs, auth
  flows, request validators, and the IP CIDR helper
- Fix Support\Ip::inNetwork PHP 8.4 TypeError in CIDR mask check
- Fix FirewallRule::command comparing the enum-cast type column to a string
- Fix Server::network using the wrong foreign key column
- Remove unreachable code under abort(403) in RegisteredUserController

tests/Feature/Drivers/Caddy2DriverTest.php

@@ -0,0 +1,65 @@
+<?php
+
+use App\Drivers\Caddy\Caddy2Driver;
+use App\Enums\ServiceType;
+use App\Models\Service;
+use App\Models\ServiceSlice;
+
+it('returns a two-step operation plan referencing the service id', function () {
+    $service = new Service(['id' => 5]);
+
+    $plan = (new Caddy2Driver(service: $service))->getOperationPlan('hash');
+
+    expect($plan->steps)->toHaveCount(2);
+    expect($plan->steps[0]->getScript())->toContain('mkdir -p /home/keystone/gateway /home/keystone/services/5');
+    expect($plan->steps[1]->getScript())->toContain('docker compose -f /home/keystone/services/5/compose.yml up -d');
+});
+
+it('reports static metadata about the caddy driver', function () {
+    $driver = new Caddy2Driver;
+
+    expect($driver->serviceType())->toBe(ServiceType::CADDY);
+    expect($driver->versionTrack())->toBe('2');
+    expect($driver->defaultImage())->toBe('caddy:2');
+    expect($driver->defaultPorts())->toBe([80, 443]);
+    expect($driver->firewallRules())->toBe(['80/tcp', '443/tcp']);
+    expect($driver->environmentSchema())->toBe([]);
+    expect($driver->resourceDefaults())->toBe([]);
+    expect($driver->updateBehavior())->toBe('stateless_redeploy');
+    expect($driver->supportedSliceTypes())->toBe(['route']);
+    expect($driver->environmentExports())->toBe([]);
+});
+
+it('renders a compose service with caddy volumes', function () {
+    $service = new Service(['id' => 8]);
+
+    $compose = (new Caddy2Driver(service: $service))->composeService();
+
+    expect($compose['image'])->toBe('caddy:2');
+    expect($compose['ports'])->toBe(['80:80', '443:443']);
+    expect($compose['volumes'])->toContain('keystone_service_8_caddy_data:/data');
+});
+
+it('declares the caddy data and config volumes', function () {
+    $service = new Service(['id' => 8]);
+
+    expect((new Caddy2Driver(service: $service))->composeVolumes())->toBe([
+        'keystone_service_8_caddy_data' => null,
+        'keystone_service_8_caddy_config' => null,
+    ]);
+});
+
+it('returns an empty environment export for a slice', function () {
+    $slice = new ServiceSlice;
+
+    expect((new Caddy2Driver)->environmentExportsForSlice($slice))->toBe([]);
+});
+
+it('emits a provisioning script for a route slice', function () {
+    $slice = new ServiceSlice(['id' => 42]);
+
+    $script = (new Caddy2Driver)->provisionSliceScript($slice);
+
+    expect($script)->toContain('mkdir -p /home/keystone/gateway/Caddyfile.d');
+    expect($script)->toContain('Caddyfile.d/42.caddy');
+});