ci: add secrets scanning, staticcheck, gosec, coverage, env docs, compose/nginx validation, a11y

New jobs in pipeline:

secrets-scan: gitleaks detection
go-staticcheck: static analysis (complement to golangci-lint)
go-gosec: Go security linter
test: coverage profiling with 50% threshold gate
env-docs-check: verifies all env vars are documented in .env.example
docker-compose-check: validates compose.yml syntax
nginx-check: validates nginx config
frontend-a11y: Svelte a11y accessibility checks

Also: remove orphaned Makefile, update .env.example with 11 missing vars,
create .gitleaks.toml with allowlist, add check-env-docs.py script.

Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent)

Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>

.gitea/workflows/ci.yaml

@@ -17,6 +17,38 @@ env:
   POSTGRES_DB: mydb
 
 jobs:
+  secrets-scan:
+    name: Secrets scan
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        shell: sh
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Fix node toolcache path for Post-step cleanup
+        run: |
+          mkdir -p /opt/hostedtoolcache/node/22.23.1/x64/bin
+          ln -sf /usr/local/bin/node /opt/hostedtoolcache/node/22.23.1/x64/bin/node
+
+      - name: Install gitleaks
+        run: go install github.com/gitleaks/gitleaks/v8@latest
+
+      - name: Detect secrets
+        run: gitleaks detect --source . --verbose --no-banner
+
+  env-docs-check:
+    name: Env docs check
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        shell: sh
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Check env var documentation
+        run: python3 scripts/check-env-docs.py
+
   go-build:
     name: Go build
     runs-on: ubuntu-latest
@@ -124,6 +156,78 @@ jobs:
           golangci-lint run ./...
         working-directory: backend
 
+  go-staticcheck:
+    name: Staticcheck
+    needs: [go-build]
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        shell: sh
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-go@v5
+        with:
+          go-version: "1.26"
+          cache: false
+
+      - name: Cache Go modules
+        uses: actions/cache@v4
+        with:
+          path: |
+            ~/go/pkg/mod
+            ~/.cache/go-build
+          key: ${{ runner.os }}-go-${{ hashFiles('backend/go.sum') }}-staticcheck
+          restore-keys: |
+            ${{ runner.os }}-go-
+
+      - name: Fix node toolcache path for Post-step cleanup
+        run: |
+          mkdir -p /opt/hostedtoolcache/node/22.23.1/x64/bin
+          ln -sf /usr/local/bin/node /opt/hostedtoolcache/node/22.23.1/x64/bin/node
+
+      - name: Staticcheck
+        run: |
+          go install honnef.co/go/tools/cmd/staticcheck@latest
+          staticcheck -tags "test,dev" ./...
+        working-directory: backend
+
+  go-gosec:
+    name: Security scan (gosec)
+    needs: [go-build]
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        shell: sh
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-go@v5
+        with:
+          go-version: "1.26"
+          cache: false
+
+      - name: Cache Go modules
+        uses: actions/cache@v4
+        with:
+          path: |
+            ~/go/pkg/mod
+            ~/.cache/go-build
+          key: ${{ runner.os }}-go-${{ hashFiles('backend/go.sum') }}-gosec
+          restore-keys: |
+            ${{ runner.os }}-go-
+
+      - name: Fix node toolcache path for Post-step cleanup
+        run: |
+          mkdir -p /opt/hostedtoolcache/node/22.23.1/x64/bin
+          ln -sf /usr/local/bin/node /opt/hostedtoolcache/node/22.23.1/x64/bin/node
+
+      - name: gosec
+        run: |
+          go install github.com/securego/gosec/v2/cmd/gosec@latest
+          gosec -severity medium -tags "test,dev" ./...
+        working-directory: backend
+
   go-mod-tidy:
     name: go mod tidy
     needs: [go-build]
@@ -165,7 +269,7 @@ jobs:
 
   test:
     name: Tests (${{ matrix.label }})
-    needs: [go-vet, go-lint, go-mod-tidy, vulns]
+    needs: [go-vet, go-lint, go-staticcheck, go-gosec, go-mod-tidy, vulns]
     runs-on: ubuntu-latest
     defaults:
       run:
@@ -188,9 +292,11 @@ jobs:
           - label: dev
             gotags: test,dev
             verbose: -v
+            coverflags: -coverprofile=coverage.out -covermode=atomic
           - label: prod
             gotags: test,!dev
             verbose: ""
+            coverflags: ""
 
     steps:
       - uses: actions/checkout@v4
@@ -230,14 +336,29 @@ jobs:
 
       - name: Run tests
         working-directory: backend
-        run: go test -tags "${{ matrix.gotags }}" -count=1 ${{ matrix.verbose }} ./...
+        run: go test -tags "${{ matrix.gotags }}" -count=1 ${{ matrix.verbose }} ${{ matrix.coverflags }} ./...
         env:
           POSTGRES_HOST: postgres
           TEST_DB_HOST: postgres
 
+      - name: Check coverage threshold
+        working-directory: backend
+        run: |
+          if [ -f coverage.out ]; then
+            COVERAGE=$(go tool cover -func=coverage.out | grep total | awk '{print $3}' | sed 's/%//')
+            echo "Total coverage: $COVERAGE%"
+            if [ "$(echo "$COVERAGE < 50" | bc)" -eq 1 ]; then
+              echo "FAIL: Coverage $COVERAGE% is below 50% threshold"
+              exit 1
+            fi
+            echo "PASS: Coverage $COVERAGE% meets 50% threshold"
+          else
+            echo "No coverage file generated (prod build)"
+          fi
+
   race:
     name: Race (${{ matrix.label }})
-    needs: [go-vet, go-lint, go-mod-tidy, vulns]
+    needs: [go-vet, go-lint, go-staticcheck, go-gosec, go-mod-tidy, vulns]
     runs-on: ubuntu-latest
     defaults:
       run:
@@ -461,6 +582,37 @@ jobs:
       - name: Run knip
         run: cd frontend && npx knip
 
+  frontend-a11y:
+    name: Frontend a11y check
+    needs: [frontend-deps]
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        shell: sh
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Fix node toolcache path for Post-step cleanup
+        run: |
+          mkdir -p /opt/hostedtoolcache/node/22.23.1/x64/bin
+          ln -sf /usr/local/bin/node /opt/hostedtoolcache/node/22.23.1/x64/bin/node
+
+      - name: Restore npm dependencies
+        uses: actions/cache@v4
+        with:
+          path: |
+            ~/.npm
+            frontend/node_modules
+          key: ${{ runner.os }}-npm-${{ hashFiles('frontend/package-lock.json') }}
+          restore-keys: |
+            ${{ runner.os }}-npm-
+
+      - name: Install dependencies
+        run: cd frontend && npm ci
+
+      - name: Check a11y
+        run: cd frontend && npm run lint:a11y
+
   frontend-build:
     name: Frontend build
     runs-on: ubuntu-latest
@@ -564,3 +716,28 @@ jobs:
 
       - name: Run QC task
         run: cd frontend && ${{ matrix.cmd }}
+
+  docker-compose-check:
+    name: Docker compose check
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        shell: sh
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Validate compose.yml
+        run: docker compose -f compose.yml config --quiet
+
+  nginx-check:
+    name: Nginx config check
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        shell: sh
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Validate nginx config
+        run: |
+          docker run --rm -v $(pwd)/nginx/conf.d/default.conf:/etc/nginx/conf.d/default.conf:ro nginx:stable-alpine nginx -t 2>&1