Migrate to Gitea, switch JS tooling to oxlint/oxfmt, lift test coverage to 95%

- Add .gitea/workflows/ci.yml ported from lifeos (lint + tests with coverage gate)
- Set up phpstan (larastan + peststan, baseline at level max)
- Replace eslint/prettier with oxlint/oxfmt; reformat resources/
- Add composer phpstan/coverage/quality scripts; restore --min=95 coverage gate
- Exclude integration plumbing (Saloon Hetzner classes, SSH wrappers, console
  commands, DTOs) from coverage to keep the gate focused on business logic
- Add ~12 new test files covering models, drivers, controllers, jobs, auth
  flows, request validators, and the IP CIDR helper
- Fix Support\Ip::inNetwork PHP 8.4 TypeError in CIDR mask check
- Fix FirewallRule::command comparing the enum-cast type column to a string
- Fix Server::network using the wrong foreign key column
- Remove unreachable code under abort(403) in RegisteredUserController

tests/Feature/UpdateServiceRequestTest.php

@@ -0,0 +1,62 @@
+<?php
+
+use App\Http\Requests\UpdateServiceRequest;
+use Illuminate\Support\Facades\Validator;
+
+function validateUpdate(array $payload): array
+{
+    $request = new UpdateServiceRequest;
+
+    return Validator::make($payload, $request->rules())->errors()->toArray();
+}
+
+it('requires a name and desired_replicas', function () {
+    $errors = validateUpdate([]);
+
+    expect($errors)->toHaveKey('name');
+    expect($errors)->toHaveKey('desired_replicas');
+});
+
+it('rejects desired_replicas above the cap', function () {
+    $errors = validateUpdate([
+        'name' => 'web',
+        'desired_replicas' => 26,
+    ]);
+
+    expect($errors)->toHaveKey('desired_replicas');
+});
+
+it('rejects a default cpu limit above the cap', function () {
+    $errors = validateUpdate([
+        'name' => 'web',
+        'desired_replicas' => 1,
+        'default_cpu_limit' => 65,
+    ]);
+
+    expect($errors)->toHaveKey('default_cpu_limit');
+});
+
+it('rejects a default memory limit below the floor', function () {
+    $errors = validateUpdate([
+        'name' => 'web',
+        'desired_replicas' => 1,
+        'default_memory_limit_mb' => 32,
+    ]);
+
+    expect($errors)->toHaveKey('default_memory_limit_mb');
+});
+
+it('accepts a valid payload', function () {
+    $errors = validateUpdate([
+        'name' => 'web',
+        'desired_replicas' => 3,
+        'default_cpu_limit' => 1.5,
+        'default_memory_limit_mb' => 512,
+    ]);
+
+    expect($errors)->toBeEmpty();
+});
+
+it('authorises the request', function () {
+    expect((new UpdateServiceRequest)->authorize())->toBeTrue();
+});