feat(gtea): build full gitea test suite (M1 build — all files)

- tests/gitea/recipe_meta.py: updated from dep-provider stub to dual-role (dep + recipe-under-test).
  Adds BACKUP_CAPABLE=True, READY_PROBE (/api/v1/version), SCREENSHOT (sign-in page), LFS-
  conditional EXTRA_ENV (compose.lfs.yml + GITEA_LFS_START_SERVER only when RECIPE=gitea AND
  overlay present — dep path unchanged). All existing dep keys preserved; 10/10 dep unit tests pass.

- tests/gitea/ops.py: NEW — admin user creation via gitea CLI (ci_admin, creds in /tmp per-domain
  file), marker repo lifecycle (pre_install/pre_upgrade/pre_backup create; pre_restore deletes to
  diverge from backup state).

- tests/gitea/test_{install,upgrade,backup,restore}.py: NEW — lifecycle overlays. Install checks
  API + admin auth + Playwright sign-in. Upgrade/backup/restore assert marker repo continuity.

- tests/gitea/custom/: NEW — test_health.py (parity: HTTP 200 root), test_git_push.py (parity:
  create→clone→push→verify→delete), test_admin_api.py (beyond-parity: user+org+token CRUD),
  test_lfs_roundtrip.py (LFS OID round-trip + JWT stability; skips on main, runs on PR #1 head).

- tests/gitea/PARITY.md: NEW — mapping table, source note (recipe-info corpus not upstream repo),
  beyond-parity rationale, backup/restore real-tier note, DB choice, dep-split mechanism, LFS skip.

- machine-docs/STATUS-gtea.md: NEW — phase status (building M1).
- machine-docs/BACKLOG-gtea.md: merged with Adversary init.
- machine-docs/JOURNAL-gtea.md: Builder log with design decisions + unit test results.
- machine-docs/REVIEW-gtea.md: kept Adversary init content.
- machine-docs/DECISIONS.md: appended gtea section (LFS split, admin mgmt, marker design).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

machine-docs/DECISIONS.md

@@ -1415,3 +1415,29 @@ The Playwright flow is deterministic: wizard → `/add` form → `/dashboard/:id
 
 **Runtime implication:** Playwright adds ~5–10 s overhead vs a headless socketio client,
 but stays well within the ≤90 s budget. Acceptable.
+
+
+## Phase gtea — gitea full-test enrollment
+
+- **Gitea dep-vs-recipe-under-test LFS split — SETTLED (2026-06-15, phase gtea).** The `EXTRA_ENV`
+  callable in `tests/gitea/recipe_meta.py` guards LFS-overlay activation with TWO conditions: (1)
+  `compose.lfs.yml` exists in `$ABRA_DIR/recipes/gitea/` (only true on the `lfs-plain-gitea` PR
+  branch, not on main), AND (2) `RECIPE=gitea` env var is set (only true when gitea is the
+  recipe-under-test, not when it's a drone dep). Both required: condition (1) ensures LFS can't
+  activate from a main checkout; condition (2) is a belt-and-suspenders guard for the dep path.
+  The dep deploy is thus byte-for-byte identical regardless of which branch the recipe checkout
+  is on. Proved by running the drone suite (dep path) on the lfs-plain-gitea checkout and
+  confirming COMPOSE_FILE stays `compose.yml:compose.sqlite3.yml`.
+
+- **Gitea admin user management — SETTLED (2026-06-15, phase gtea).** Gitea has no default admin
+  user after `abra app deploy`. `ops.pre_install` creates `ci_admin` via `gitea admin user create`
+  CLI inside the container (same mechanism as `sso.setup_gitea_oauth` for drone dep), stores the
+  generated password at `/tmp/ccci-gitea-admin-<domain>.json` (mode 600). All subsequent
+  `pre_<op>` hooks read from this file. File is per-run-domain (domains are unique per run so no
+  cross-run collision), transient (not cleaned up explicitly but overwritten on any reuse).
+
+- **Gitea data-integrity marker — SETTLED (2026-06-15, phase gtea).** Marker = git repo `ci-marker`
+  owned by `ci_admin`, created with `auto_init=True` (has a README.md initial commit). API-based
+  (same model as keycloak realm marker). Idempotent creation (409 = already exists → OK).
+  `pre_restore` deletes it to create a genuine divergence from backup state; `test_restore` asserts
+  its return. The sqlite3 DB is the persistence layer being tested.