ci(audio-api): hermetic test deps + Gitea Actions workflow (#35)

The 67-test suite existed and was green, but only under a
--system-site-packages venv — which made it quietly host-dependent. A
system python bump to 3.14 dropped fastapi/httpx from that venv and the
whole suite went to "no tests collected" (red, but for an env reason, not
a code reason). CI that inherits the host's site-packages would hide
exactly this class of breakage.

Fix = make the suite hermetic and prove it:
- requirements-test.txt pins the real test surface — fastapi/uvicorn/
  multipart (via requirements.txt) + numpy + soundfile + librosa +
  pyloudnorm + httpx + pytest. NOT --system-site-packages.
- The heavy ML stack (torch, laion_clap, demucs) is deliberately absent:
  those engines aren't exercised by the tests, so CI installs in seconds-
  to-a-minute instead of pulling multi-GB wheels.
- Rehearsed in a clean throwaway venv: first run surfaced two masked deps
  the system venv had been silently supplying — librosa (lazy-imported by
  signal/feats/ears/grade) and pyloudnorm (the LUFS loudness engine).
  Pinned both; clean-venv run is now 67 passed.
- .gitea/workflows/api-ci.yml runs it on git.plnech.fr for any push/PR
  touching armada/api/**. Dormant until an act_runner is registered for
  the repo; the workflow is correct and locally rehearsed.

Closes the test-suite + CI task (#35): the suite is reproducible and the
pipeline is declared.

.gitea/workflows/api-ci.yml

+# Nech.PL Audio API — CI. Runs the armada/api test suite on every push/PR that
+# touches the service. Hermetic install (requirements-test.txt), no
+# system-site-packages — a host python bump can't silently break it.
+#
+# Gitea Actions (git.plnech.fr). Dormant until an act_runner is registered for
+# this repo; the workflow itself is correct and rehearsed locally (67 passed in
+# a clean venv, 2026-06-28).
+name: api-ci
+
+on:
+  push:
+    paths:
+      - 'armada/api/**'
+      - '.gitea/workflows/api-ci.yml'
+  pull_request:
+    paths:
+      - 'armada/api/**'
+      - '.gitea/workflows/api-ci.yml'
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: armada/api
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-python@v5
+        with:
+          python-version: '3.12'
+
+      - name: Install test deps (hermetic)
+        run: |
+          python -m pip install --upgrade pip
+          pip install -r requirements-test.txt
+
+      - name: Run test suite
+        run: python -m pytest -q

armada/api/requirements-test.txt

+# Douanier API — reproducible TEST deps (CI + a clean local run).
+#
+# Deliberately NOT --system-site-packages: the suite must install standalone so
+# CI is hermetic and a host python upgrade can't silently break it (it did once:
+# system python3 -> 3.14 dropped fastapi from the venv, suite went red).
+#
+# The heavy ML stack (torch, laion_clap, demucs) is NOT needed by the tests —
+# those engines are mocked / not exercised. librosa+soundfile+numpy ARE, because
+# the signal/feats/ears/grade engine tests run real DSP on tiny synthetic clips.
+#
+#   python3 -m venv .venv && .venv/bin/pip install -r requirements-test.txt
+#   .venv/bin/python -m pytest -q
+#
+-r requirements.txt          # fastapi, uvicorn, python-multipart
+numpy>=1.26
+soundfile>=0.12
+librosa>=0.10                 # lazy-imported by engines; needed for signal/feats/ears/grade tests
+pyloudnorm>=0.1               # loudness engine: integrated LUFS (test_loudness_engine_measures_lufs)
+pytest>=8.0
+httpx>=0.27                   # fastapi TestClient transport