ci: add Gitea Actions workflow for automated testing

- Create .gitea/workflows/ci.yml with 4 sequential jobs
  - lint: Run ESLint on root configuration
  - test-backend: Run backend Vitest tests with SQLite
  - test-frontend: Run frontend Vitest tests
  - test-e2e: Run Playwright E2E tests (bloqueante)
- E2E job automates server startup + Playwright test execution
- Configure Gitea Secrets for IGDB, RAWG, TheGamesDB API keys
- Add artifact upload for Playwright reports on failure
- Update SECURITY.md with CI/CD Secrets setup instructions
- Update docs/API_KEYS.md with production Gitea workflow guide
- Add tests/gitea-workflow.spec.ts with 12 validation tests
- Workflow triggers on push/PR to main and develop branches

docs/API_KEYS.md

@@ -74,11 +74,63 @@ For development/testing:
 For production:
 
 1. Generate new keys on each service (don't reuse dev keys)
-2. Store keys in **Gitea Secrets** (for CI/CD)
+2. Store keys in **Gitea Secrets** (for automated CI/CD pipelines)
 3. Or use environment variables on your hosting provider
 4. Rotate keys every 3 months
 5. Monitor rate limits in service dashboards
 
+## Gitea Actions CI/CD Setup
+
+To enable automated testing with API keys in Gitea Actions:
+
+### 1. Store Secrets in Gitea
+
+Navigate to your repository settings:
+
+```
+https://your-gitea-instance/your-org/quasar/settings/secrets/actions
+```
+
+Add these secrets:
+
+- `IGDB_CLIENT_ID` (from Twitch Developer Console)
+- `IGDB_CLIENT_SECRET` (from Twitch Developer Console)
+- `RAWG_API_KEY` (from RAWG settings)
+- `THEGAMESDB_API_KEY` (from TheGamesDB API)
+
+### 2. Workflow Configuration
+
+The `.gitea/workflows/ci.yml` workflow automatically:
+
+- ✅ Installs dependencies
+- ✅ Runs linting checks
+- ✅ Executes backend tests (Vitest)
+- ✅ Executes frontend tests (Vitest)
+- ✅ Starts backend + frontend servers
+- ✅ Runs E2E tests (Playwright) with real metadata APIs
+- ✅ Uploads test reports on failure
+
+### 3. Testing Flow
+
+1. **Push** code to `main` or `develop`
+2. **Gitea Actions** picks up the `.gitea/workflows/ci.yml`
+3. **Secrets are injected** as `IGDB_CLIENT_ID`, `IGDB_CLIENT_SECRET`, `RAWG_API_KEY`, `THEGAMESDB_API_KEY`
+4. **E2E tests** fetch real metadata from APIs (using injected secrets)
+5. **Build fails** if any test fails (prevents broken code)
+
+### 4. Local Development
+
+For local testing, use `.env.local`:
+
+```bash
+IGDB_CLIENT_ID=your_local_id
+IGDB_CLIENT_SECRET=your_local_secret
+RAWG_API_KEY=your_local_key
+THEGAMESDB_API_KEY=your_local_key
+```
+
+**Note:** CI/CD uses Gitea Secrets (not `.env` files), so never commit real credentials.
+
 ## Troubleshooting
 
 **"IGDB_CLIENT_ID not found"** → Check `.env` file exists and has correct format