ci(gitea): kill leftover webServer process and cap job at 25min

Playwright's webServer (http-server) wasn't exiting after the e2e
step, holding stdout open and hanging Gitea's Complete job step
indefinitely (observed run #13 stuck past 6 minutes with no progress).
Add an explicit cleanup step plus a job-level timeout as a backstop.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

.gitea/workflows/qa.yml

@@ -0,0 +1,107 @@
+name: Caterium QA
+on:
+  push:
+  pull_request:
+concurrency:
+  group: caterium-qa-${{ github.ref }}
+  cancel-in-progress: true
+jobs:
+  qa:
+    runs-on: ubuntu-latest
+    # Belt-and-braces cap on the whole job. Without it, a step whose
+    # background process doesn't exit cleanly (see the e2e step below) can
+    # hang "Complete job" indefinitely instead of just failing the step.
+    timeout-minutes: 25
+    env:
+      # registry.npmjs.org sits behind Cloudflare IPs that this self-hosted
+      # runner cannot reach (times out on both IPv4 and IPv6). npmmirror.com
+      # mirrors the full npm registry and is reachable, so point npm at it
+      # instead of failing every install. GitHub-hosted runners don't need
+      # this, which is why .github/workflows/qa.yml doesn't set it.
+      NPM_CONFIG_REGISTRY: https://registry.npmmirror.com
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+      - run: npm ci
+      - name: Audit dependencies (retry service errors only)
+        # npmmirror.com (see NPM_CONFIG_REGISTRY above) doesn't implement
+        # npm's bulk security-advisories endpoint, so this always reports
+        # "audit endpoint returned an error" here even though installs
+        # work fine. The real audit still runs on GitHub-hosted runners
+        # against registry.npmjs.org (.github/workflows/qa.yml), so don't
+        # fail the whole Gitea pipeline over a check this runner can't
+        # physically perform.
+        continue-on-error: true
+        timeout-minutes: 4
+        shell: bash
+        run: |
+          set -euo pipefail
+          report="$(mktemp)"
+          trap 'rm -f "$report"' EXIT
+          for attempt in 1 2 3; do
+            set +e
+            npm audit --audit-level=high --loglevel=verbose > "$report" 2>&1
+            status=$?
+            set -e
+            cat "$report"
+            if [ "$status" -eq 0 ]; then exit 0; fi
+            # An actual vulnerability report fails immediately. A failed
+            # registry response is retried, never accepted as a clean audit.
+            if ! grep -Eq 'audit endpoint returned an error|ENOTFOUND|ECONNRESET|EAI_AGAIN|ETIMEDOUT|E429|E503' "$report"; then
+              exit "$status"
+            fi
+            if [ "$attempt" -eq 3 ]; then exit "$status"; fi
+            echo "Audit service unavailable; retry $attempt/3 after a delay."
+            sleep "$((attempt * 20))"
+          done
+          exit 1
+      - run: npm run check:deploy
+      - name: Install PHP CLI
+        # The self-hosted act_runner image (unlike GitHub's ubuntu-latest)
+        # ships without PHP at all, so the lint/proxy steps below fail with
+        # "php: command not found" unless we install it first. php-curl is
+        # needed too: tests/proxy-http.php calls CURLOPT_* constants, which
+        # the bare php-cli package doesn't define.
+        run: |
+          apt-get update -y
+          apt-get install -y --no-install-recommends php-cli php-curl
+      - run: php -l public/api/index.php && php -l ops/timeweb/api-proxy.php
+      - run: php tests/proxy-http.php app && php tests/proxy-http.php api
+      - run: npx playwright install --with-deps chromium
+      - name: Run e2e tests (desktop/chromium subset only)
+        # This VPS (2 CPU / 4GB) also runs Gitea + Postgres + Caddy. Running
+        # the full suite (4 projects, chromium + webkit) even at --workers=1
+        # has twice driven the host into an unresponsive state needing a hard
+        # reboot, and after adding 2GB of swap to stop the crashing, the same
+        # full run instead thrashed on disk I/O badly enough that ~67 tests
+        # timed out (page loads taking far longer than their 30-90s budgets)
+        # over a 56-minute run. This runner physically can't carry the full
+        # matrix alongside Gitea itself.
+        #
+        # So here we only install chromium (not webkit) and only run the
+        # "desktop" project — the fastest, lowest-memory subset — as a quick
+        # smoke check, and don't fail the pipeline on it (continue-on-error):
+        # it's a bonus signal, not the source of truth. The real, full e2e
+        # matrix (all 4 projects, chromium+webkit, full parallelism) runs on
+        # GitHub-hosted runners in .github/workflows/qa.yml, which have the
+        # headroom this VPS doesn't. GitHub Actions minutes are exhausted for
+        # this billing cycle (resets in ~7 days) — until then this Gitea
+        # smoke check is the only e2e signal, but it's better than nothing.
+        continue-on-error: true
+        timeout-minutes: 15
+        run: npx playwright test --config=tests/playwright.config.mjs --project=desktop --workers=1
+      - name: Stop leftover webServer process
+        # Playwright's `webServer` (npx http-server, started for the e2e step
+        # above) is meant to be killed automatically once the test run ends,
+        # but in this runner's container it has been staying alive and
+        # holding the step's stdout open, which hangs Gitea's "Complete job"
+        # indefinitely instead of finishing normally. Killing anything still
+        # listening on the webServer's port (4173) clears that up. if: always()
+        # so this runs even if the e2e step above timed out or failed.
+        if: always()
+        run: |
+          pkill -f "http-server public" || true
+          fuser -k 4173/tcp 2>/dev/null || true
+          exit 0