Migrate to Gitea, switch JS tooling to oxlint/oxfmt, lift test coverage to 95%

- Add .gitea/workflows/ci.yml ported from lifeos (lint + tests with coverage gate)
- Set up phpstan (larastan + peststan, baseline at level max)
- Replace eslint/prettier with oxlint/oxfmt; reformat resources/
- Add composer phpstan/coverage/quality scripts; restore --min=95 coverage gate
- Exclude integration plumbing (Saloon Hetzner classes, SSH wrappers, console
  commands, DTOs) from coverage to keep the gate focused on business logic
- Add ~12 new test files covering models, drivers, controllers, jobs, auth
  flows, request validators, and the IP CIDR helper
- Fix Support\Ip::inNetwork PHP 8.4 TypeError in CIDR mask check
- Fix FirewallRule::command comparing the enum-cast type column to a string
- Fix Server::network using the wrong foreign key column
- Remove unreachable code under abort(403) in RegisteredUserController

tests/Feature/Drivers/LaravelRuntimeDriverTest.php

@@ -0,0 +1,91 @@
+<?php
+
+use App\Drivers\Laravel\LaravelRuntimeDriver;
+use App\Enums\ServiceType;
+use App\Models\Service;
+
+it('reports static metadata about the laravel runtime driver', function () {
+    $driver = new LaravelRuntimeDriver;
+
+    expect($driver->serviceType())->toBe(ServiceType::LARAVEL);
+    expect($driver->versionTrack())->toBe('php-8.4');
+    expect($driver->defaultImage())->toBe('serversideup/php:8.4-frankenphp');
+    expect($driver->defaultPorts())->toBe([80]);
+    expect($driver->firewallRules())->toBe([]);
+    expect($driver->environmentSchema())->toBe([
+        'APP_ENV' => 'string',
+        'SERVER_NAME' => 'string',
+    ]);
+    expect($driver->resourceDefaults())->toBe([]);
+    expect($driver->updateBehavior())->toBe('stateless_gateway_cutover');
+    expect($driver->composeVolumes())->toBe([]);
+});
+
+it('builds a compose service with healthchecks for non-worker services', function () {
+    $service = new Service([
+        'id' => 1,
+        'process_roles' => ['web'],
+        'config' => [],
+        'desired_replicas' => 1,
+    ]);
+
+    $compose = (new LaravelRuntimeDriver(service: $service))->composeService();
+
+    expect($compose['image'])->toBe('serversideup/php:8.4-frankenphp');
+    expect($compose['restart'])->toBe('unless-stopped');
+    expect($compose['healthcheck']['test'])->toContain('CMD-SHELL');
+});
+
+it('omits the healthcheck for worker services and adds custom command/cpu/memory', function () {
+    $service = new Service([
+        'id' => 2,
+        'process_roles' => ['worker'],
+        'config' => ['command' => 'php artisan queue:work'],
+        'default_cpu_limit' => 2,
+        'default_memory_limit_mb' => 512,
+        'desired_replicas' => 1,
+    ]);
+
+    $compose = (new LaravelRuntimeDriver(service: $service))->composeService();
+
+    expect($compose)->not->toHaveKey('healthcheck');
+    expect($compose['command'])->toBe('php artisan queue:work');
+    expect($compose['cpus'])->toBe('2.000');
+    expect($compose['mem_limit'])->toBe('512m');
+    expect($compose['memswap_limit'])->toBe('512m');
+});
+
+it('emits a dockerfile that defers to env-supplied php and document root values', function () {
+    $service = new Service([
+        'config' => [
+            'php_version' => '8.3',
+            'document_root' => 'public-html',
+            'js_build_command' => 'bun run build',
+        ],
+    ]);
+
+    $dockerfile = (new LaravelRuntimeDriver(service: $service))->dockerfileTemplate();
+
+    expect($dockerfile)->toContain('FROM serversideup/php:8.3-frankenphp');
+    expect($dockerfile)->toContain('SERVER_DOCUMENT_ROOT=/var/www/html/public-html');
+    expect($dockerfile)->toContain('bun install --frozen-lockfile && bun run build');
+});
+
+it('supports the npm package manager in dockerfile generation', function () {
+    $service = new Service([
+        'config' => [
+            'js_build_command' => 'npm run build',
+            'js_package_manager' => 'npm',
+        ],
+    ]);
+
+    expect((new LaravelRuntimeDriver(service: $service))->dockerfileTemplate())
+        ->toContain('npm ci && npm run build');
+});
+
+it('skips js build steps when no build command is configured', function () {
+    $service = new Service(['config' => []]);
+
+    expect((new LaravelRuntimeDriver(service: $service))->dockerfileTemplate())
+        ->not->toContain('bun install');
+});