Stage 1: backend foundation (Postgres, sessions, accounts, OTel)

- internal/postgres: pgx-over-database/sql pool (otelsql), embedded goose
  migrations into schema 'backend', committed go-jet code + cmd/jetgen tool.
- internal/account: durable accounts + unified telegram/email identities
  (UUIDv7 keys), find-or-create provisioning with unique-conflict handling.
- internal/session: opaque 256-bit tokens stored as a SHA-256 hash, revoke-only
  (no TTL); write-through cache gating /readyz; store + service.
- internal/telemetry: OTel tracer/meter providers (none/stdout) + request-timing
  middleware; internal/config gains Postgres + OTel env loading.
- internal/server: /api/v1 {public,user,internal,admin} skeleton + X-User-ID
  middleware; /readyz checks DB ping + cache; main wires
  telemetry -> db+migrate -> warm cache -> server.
- Tests: unit + integration (build tag 'integration', testcontainers
  postgres:17) for migrations, accounts, sessions, readyz; new integration.yaml.
- Docs: ARCHITECTURE, TESTING, PLAN refinements, root + backend READMEs.

Session/account REST handlers deferred to Stage 6 (gateway); OTLP + dashboards
to Stage 11.

.gitea/workflows/integration.yaml

@@ -0,0 +1,50 @@
+name: Tests · Integration
+
+# Postgres-backed integration tests for the Go backend, gated behind the
+# `integration` build tag. They spin a throwaway postgres:17-alpine container via
+# testcontainers-go, which reaches the host Docker daemon through the socket the
+# Gitea runner exposes. Slower than the unit job (go-unit.yaml); run serially
+# (-p=1) with Ryuk disabled — TestMain terminates its own container. The module
+# list grows as new go.work modules are added by later stages.
+
+on:
+  push:
+    paths:
+      - 'backend/**'
+      - 'go.work'
+      - 'go.work.sum'
+      - '.gitea/workflows/integration.yaml'
+      - '!**/*.md'
+  pull_request:
+    paths:
+      - 'backend/**'
+      - 'go.work'
+      - 'go.work.sum'
+      - '.gitea/workflows/integration.yaml'
+      - '!**/*.md'
+
+jobs:
+  integration:
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        shell: bash
+    env:
+      # Ryuk (testcontainers' reaper) does not start cleanly on every runner;
+      # the suite's TestMain terminates its own container, so disable it.
+      TESTCONTAINERS_RYUK_DISABLED: "true"
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Set up Go
+        uses: actions/setup-go@v5
+        with:
+          go-version-file: go.work
+          cache: true
+
+      - name: Integration tests
+        # -count=1 disables the test cache; -p=1 -parallel=1 keeps the
+        # container-backed tests serial; the 15-minute timeout bounds a stuck
+        # container pull.
+        run: go test -tags=integration -count=1 -p=1 -parallel=1 -timeout=15m ./backend/...