CI: run backoffice test suite on push/PR, document local test setup

Adds .gitea/workflows/test-backoffice.yml (paths-filtered to
backoffice/app/** and backoffice/db/**, self-hosted homelab runner,
plain git clone matching deploy-backoffice.yml's conventions) so a
regression no longer needs a human to notice it.

The psycopg[binary]==3.2.1 pin turned out to be correct, not stale: it
only ships wheels through cp312, so it resolves cleanly under the
project's python:3.12-slim target but not under newer interpreters.
Documented in requirements.txt and docs/agents/testing.md, along with
the fact that the suite spins up its own throwaway postgres:16-alpine
container (tests/conftest.py) with no manual DB setup required.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

.gitea/workflows/test-backoffice.yml

@@ -0,0 +1,65 @@
+name: Test backoffice (smb-crm)
+
+# Automatic, unlike deploy-backoffice.yml: this workflow never touches the
+# live host, only spins up a throwaway postgres:16-alpine container via the
+# test suite itself (see backoffice/app/tests/conftest.py), so it's safe to
+# run on every push/PR. Scoped to the paths that can actually affect these
+# tests so unrelated changes elsewhere (n8n/, deploy/, docs/, etc.) don't
+# trigger a run.
+on:
+  push:
+    paths:
+      - "backoffice/app/**"
+      - "backoffice/db/**"
+  pull_request:
+    paths:
+      - "backoffice/app/**"
+      - "backoffice/db/**"
+
+jobs:
+  test:
+    runs-on: [self-hosted, homelab]
+    steps:
+      # Plain git + fetch-by-sha instead of actions/checkout@v4 (Node.js
+      # based; this runner deliberately has no Node toolchain) and instead
+      # of deploy-backoffice.yml's branch-name clone (that workflow is
+      # workflow_dispatch-only with a branch/tag input; push/pull_request
+      # give us a commit SHA via github.sha, which needs a fetch-by-SHA, not
+      # a branch checkout, to be exact for PRs).
+      - name: Checkout
+        env:
+          DEPLOY_TOKEN: ${{ secrets.DEPLOY_TOKEN }}
+          GIT_SHA: ${{ github.sha }}
+        run: |
+          set -euo pipefail
+          find . -mindepth 1 -delete
+          git init -q
+          git remote add origin "http://${DEPLOY_TOKEN}@172.24.0.2:3000/BPPP/smb-online.git"
+          git fetch --depth 1 origin "$GIT_SHA"
+          git checkout -q FETCH_HEAD
+          git remote set-url origin http://172.24.0.2:3000/BPPP/smb-online.git
+
+      # This runner is bare-metal (no guaranteed python3.12 binary), but it
+      # already has docker access (see deploy-backoffice.yml), so the venv is
+      # built inside a python:3.12-slim container — the same base image
+      # backoffice/app/Dockerfile ships on, so "3.12 venv" here means exactly
+      # what runs in production, with zero assumptions about the host's own
+      # Python. --network host is required: tests/conftest.py itself runs
+      # `docker run -p 127.0.0.1:<port>:5432 postgres:16-alpine` as a sibling
+      # container (via the mounted docker socket), and the test process must
+      # see that published port on the same network namespace it lands in.
+      - name: Install deps and run backoffice test suite (python:3.12-slim)
+        run: |
+          set -euo pipefail
+          docker run --rm --network host \
+            -v "$PWD":/repo \
+            -v /var/run/docker.sock:/var/run/docker.sock \
+            -w /repo \
+            -e HOME=/tmp \
+            python:3.12-slim bash -euxc '
+              apt-get update -qq && DEBIAN_FRONTEND=noninteractive apt-get install -y -qq docker.io >/dev/null
+              python3 -m venv .venv
+              .venv/bin/pip install -q --upgrade pip
+              .venv/bin/pip install -q -r backoffice/app/requirements-dev.txt
+              .venv/bin/python -m pytest backoffice/app/tests -q
+            '