Run isolated PostgreSQL and RustFS tests in Gitea CI

tests/integration/compose.yaml

@@ -1,10 +1,10 @@
 # Disposable tests ONLY. Known test credentials are intentionally not production secrets.
+# No published ports: tests run on this isolated network, including in nested Gitea jobs.
 services:
   postgres:
     image: postgres:18.0-bookworm
     environment:
       POSTGRES_PASSWORD: disposable-test
-    ports: ["127.0.0.1:15432:5432"]
     tmpfs: ["/var/lib/postgresql"]
     healthcheck:
       test: ["CMD-SHELL", "pg_isready -U postgres"]
@@ -19,7 +19,25 @@ services:
       RUSTFS_CONSOLE_ENABLE: "false"
       RUSTFS_OBS_LOG_DIRECTORY: /logs
     command: ["/data"]
-    ports: ["127.0.0.1:19000:9000"]
     tmpfs:
       - /data:uid=10001,gid=10001
       - /logs:uid=10001,gid=10001
+  tests:
+    image: python:3.12.12-slim-bookworm
+    working_dir: /app
+    environment:
+      PYTHONPATH: /app/src
+      TEST_PGHOST: postgres
+      TEST_PGPORT: "5432"
+      TEST_PGUSER: postgres
+      TEST_PGPASSWORD: disposable-test
+      TEST_S3_ENDPOINT_URL: http://rustfs:9000
+      TEST_S3_ACCESS_KEY: disposable-test
+      TEST_S3_SECRET_KEY: disposable-test-secret
+    command:
+      - /bin/sh
+      - -c
+      - >-
+        pip install --disable-pip-version-check --require-hashes -r requirements-test.lock &&
+        python scripts/wait-test-infrastructure.py &&
+        python -m pytest -q