ci: run the checks that only ran on a laptop; mobile in CI; retries 0

CI ran Playwright (chromium-desktop) + the dependency audit and nothing else. cargo test,
clippy, the frontend vitest suite, svelte-check and the e2e typecheck were all green on a
developer's machine and gated NOTHING.

  checks.yml (new): cargo test (with a Postgres service; --test-threads bounded so the
    sqlx per-test DBs can't exhaust connections) + clippy; vitest + svelte-check; e2e tsc.
  e2e.yml: also run the chromium-mobile project — 22 tests (focus traps, touch targets,
    safe-area, viewport reflow) that never ran in CI on a phone-first app.
  playwright.config: widen webkit-iphone beyond @smoke (2 specs) to the core guest journeys
    (auth/upload/feed) — iOS Safari is the PRIMARY browser here; and retries 2 → 0.

retries:0 is deliberate and against the usual advice: this repo's real bugs are races, a
race is indistinguishable from a flake from outside, and a retry resolves that ambiguity
toward "flake" every time — it took a real 3%-flaky product bug from 1-in-33 to 1-in-37000,
green. A flake here is a bug report.

Not gated: cargo fmt (the tree has never been rustfmt'd — a 112-file reformat would bury
every real diff; do it separately). WebKit widening is unverified locally (needs libavif16
via sudo), so its first CI run may surface real iOS bugs.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

README.md

@@ -182,6 +182,28 @@ The `/media` volume holds originals, previews, thumbnails, exports, and DB backu
 
 ---
 
+## Running the backend test suite
+
+```bash
+cd backend
+
+# The DB-backed integration tests (backend/tests/) need a live Postgres. `#[sqlx::test]` creates a
+# throwaway database per test and runs backend/migrations/ into it — it does NOT touch this one's data.
+docker run -d --name eventsnap-test-pg -p 55433:5432 \
+  -e POSTGRES_PASSWORD=postgres -e POSTGRES_DB=eventsnap postgres:16-alpine
+
+export DATABASE_URL=postgres://postgres:postgres@localhost:55433/eventsnap
+cargo test        # 44 unit + 12 DB-backed
+cargo clippy --all-targets -- -D warnings
+```
+
+**`cargo test` requires `DATABASE_URL`** — without it the integration tests panic rather than skip.
+That is deliberate. The riskiest code in this repo is SQL (the export epoch state machine, the
+atomic quota increment, the `FOR SHARE` upload lock), and for a long time *not one line of it* was
+executed by `cargo test` — every backend test was a pure-function test, so the tests clustered
+tightly around the code that could not break and stopped exactly where it started to. Tests that
+silently skip when the database is absent recreate that hole; they were meant to be a gate.
+
 ## Running the E2E test suite
 
 Playwright-based end-to-end tests live in [`e2e/`](e2e/). They spin up an isolated docker-compose stack (Postgres on `:55432`, Caddy on `:3101`) and exercise the SvelteKit frontend against the real Rust backend with rate limits disabled.
@@ -198,7 +220,14 @@ npm run stack:down            # tear it down
 
 See [`e2e/README.md`](e2e/README.md) for the full UA matrix, Samsung Internet escalation tiers, and the Phase 2/3 roadmap.
 
-CI runs this on every PR — see [`.github/workflows/e2e.yml`](.github/workflows/e2e.yml).
+CI runs this on every PR — see [`.github/workflows/e2e.yml`](.github/workflows/e2e.yml) (desktop **and**
+mobile projects), plus [`checks.yml`](.github/workflows/checks.yml) for `cargo test`/clippy, the frontend
+unit tests, svelte-check and the e2e typecheck, and [`audit.yml`](.github/workflows/audit.yml) for
+dependency advisories.
+
+**Playwright runs with `retries: 0`, including in CI.** This repo's real bugs are races, and from the
+outside a race is indistinguishable from a flake — so a retry silently resolves that ambiguity in
+favour of "flake" every time. A flake here is a bug report; treat it as one.
 
 ---