ci: run the checks that only ran on a laptop; mobile in CI; retries 0

CI ran Playwright (chromium-desktop) + the dependency audit and nothing else. cargo test,
clippy, the frontend vitest suite, svelte-check and the e2e typecheck were all green on a
developer's machine and gated NOTHING.

  checks.yml (new): cargo test (with a Postgres service; --test-threads bounded so the
    sqlx per-test DBs can't exhaust connections) + clippy; vitest + svelte-check; e2e tsc.
  e2e.yml: also run the chromium-mobile project — 22 tests (focus traps, touch targets,
    safe-area, viewport reflow) that never ran in CI on a phone-first app.
  playwright.config: widen webkit-iphone beyond @smoke (2 specs) to the core guest journeys
    (auth/upload/feed) — iOS Safari is the PRIMARY browser here; and retries 2 → 0.

retries:0 is deliberate and against the usual advice: this repo's real bugs are races, a
race is indistinguishable from a flake from outside, and a retry resolves that ambiguity
toward "flake" every time — it took a real 3%-flaky product bug from 1-in-33 to 1-in-37000,
green. A flake here is a bug report.

Not gated: cargo fmt (the tree has never been rustfmt'd — a 112-file reformat would bury
every real diff; do it separately). WebKit widening is unverified locally (needs libavif16
via sudo), so its first CI run may surface real iOS bugs.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.github/workflows/checks.yml

@@ -0,0 +1,113 @@
+# The checks that were only ever running on a laptop.
+#
+# Before this file, CI ran Playwright (chromium-desktop) and the dependency audit — and nothing
+# else. `cargo test` (40 tests), the frontend vitest suite (5 files, including the offline
+# upload-queue and auth-token logic), svelte-check, and the e2e typecheck were all green on a
+# developer's machine and gated NOTHING. A check that only ever runs locally is not running.
+#
+# In .github/workflows/ because Gitea Actions scans it too (see audit.yml). Rust is installed
+# explicitly: the common Gitea runner images ship Node and Docker, not cargo.
+name: Checks
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+
+jobs:
+  backend:
+    name: Backend — cargo test + clippy + fmt
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install Rust toolchain
+        run: |
+          if ! command -v cargo > /dev/null; then
+            curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --profile minimal
+            echo "$HOME/.cargo/bin" >> "$GITHUB_PATH"
+          fi
+          rustup component add clippy rustfmt
+
+      - uses: actions/cache@v4
+        with:
+          path: |
+            ~/.cargo/registry
+            ~/.cargo/git
+            backend/target
+          key: cargo-${{ hashFiles('backend/Cargo.lock') }}
+          restore-keys: cargo-
+
+      # SQLx runs its queries against a live database at TEST time (see backend/tests/), so the
+      # DB-backed tests need one. The pure unit tests don't care, but starting it unconditionally
+      # keeps the job simple and honest about what it covers.
+      - name: Start Postgres
+        run: |
+          docker run -d --name ci-pg -p 5432:5432 \
+            -e POSTGRES_PASSWORD=postgres -e POSTGRES_DB=eventsnap_ci \
+            postgres:16-alpine
+          for _ in $(seq 1 30); do
+            docker exec ci-pg pg_isready -U postgres > /dev/null 2>&1 && break
+            sleep 1
+          done
+
+      - name: Test
+        working-directory: ./backend
+        env:
+          DATABASE_URL: postgres://postgres:postgres@localhost:5432/eventsnap_ci
+        # `#[sqlx::test]` creates a fresh database per test and opens its own pool; run at unbounded
+        # parallelism against a default `max_connections=100` Postgres, a full suite can exhaust the
+        # server's connection slots and fail with PoolTimedOut — a pure infra flake, not a real
+        # failure. Cap the concurrency so the gate stays trustworthy on a loaded runner.
+        run: cargo test --all-features -- --test-threads=8
+
+      - name: Clippy
+        working-directory: ./backend
+        run: cargo clippy --all-targets -- -D warnings
+
+      # NOTE: `cargo fmt --check` is deliberately NOT gated. The tree has never been rustfmt'd, so
+      # turning it on means a 112-file mechanical reformat that would bury every real diff under it.
+      # Formatting is not a correctness gate; do that cleanup on its own, then add the check here.
+
+  frontend:
+    name: Frontend — vitest + svelte-check
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '22'
+          cache: 'npm'
+          cache-dependency-path: 'frontend/package-lock.json'
+
+      - name: Install deps
+        working-directory: ./frontend
+        run: npm ci || npm install
+
+      - name: Unit tests
+        working-directory: ./frontend
+        run: npm run test:unit
+
+      - name: svelte-check
+        working-directory: ./frontend
+        run: npx svelte-check --threshold error
+
+  e2e-typecheck:
+    name: E2E — typecheck
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '22'
+      - name: Install deps
+        working-directory: ./e2e
+        run: npm install
+      # Playwright TRANSPILES specs without typechecking them, so a type error in a spec is
+      # invisible until the assertion it guards silently does the wrong thing at runtime.
+      - name: tsc --noEmit
+        working-directory: ./e2e
+        run: npx tsc --noEmit

.github/workflows/e2e.yml

@@ -46,6 +46,14 @@ jobs:
         working-directory: ./e2e
         run: npm run test:e2e -- --project=chromium-desktop
 
+      # 09-mobile is `testIgnore`d on chromium-desktop (it needs hasTouch + a phone viewport), so
+      # running only that project left 22 tests — focus traps, touch targets, safe-area insets,
+      # viewport reflow, upload-cancel — never executing in CI. On a phone-first event app, where
+      # essentially every real guest is on a phone, that was the wrong half of the suite to skip.
+      - name: Run E2E tests (mobile)
+        working-directory: ./e2e
+        run: npm run test:e2e -- --project=chromium-mobile
+
       - name: Upload Playwright report
         if: failure()
         uses: actions/upload-artifact@v4