Add pytest suite and Gitea Actions CI/CD pipeline

83 tests (94% coverage of src/py) covering the builder pipeline
(gallery sync, HTML/CSS generation, image processing, full site
build) and the Flask webui (routes, uploads, theme/font management).

Dockerfile gains a `test` stage (pytest) between the wheel builder
and the prod image, and pins the alpine base to a full patch tag so
Renovate can classify updates. CI workflow builds, smoke-tests, runs
the suite, scans with Trivy, and publishes/releases on merge to main,
following the same pipeline already running on adguard-cidre.

Dockerfile

@@ -1,4 +1,4 @@
-FROM python:3.13-alpine AS builder
+FROM python:3.13.15-alpine AS builder
 
 WORKDIR /app
 
@@ -7,7 +7,7 @@ RUN apk add --no-cache gcc musl-dev jpeg-dev zlib-dev
 COPY requirements.txt .
 RUN pip wheel --no-cache-dir --wheel-dir=/wheels -r requirements.txt
 
-FROM python:3.13-alpine
+FROM python:3.13.15-alpine AS base
 
 WORKDIR /app
 
@@ -20,4 +20,13 @@ COPY ./config /app/default
 COPY ./docker/.sh/entrypoint.sh /app/entrypoint.sh
 RUN chmod +x /app/entrypoint.sh
 
+FROM base AS test
+
+COPY requirements.txt requirements-dev.txt pytest.ini /app/
+RUN pip install --no-cache-dir -r requirements-dev.txt
+COPY ./tests/ ./tests/
+COPY ./demo/ ./demo/
+
+FROM base
+
 ENTRYPOINT ["/app/entrypoint.sh"]