Add Go backend unit and handler tests; wire test step into CI

- Introduce store interfaces (TrackpointStorer, StopStorer, SuggestionStorer)
  in internal/db/interfaces.go so handlers can be tested without a real DB.
- Refactor HandleSingleTrackpoint, HandleBatchTrackpoints, HandleListDays,
  HandleListTrackpoints, HandleListStops, HandleListSuggestions to accept
  the new interfaces instead of concrete *db.*Store pointers (no behaviour
  change; concrete types satisfy the interfaces implicitly).
- internal/api/ingest_test.go: 13 handler tests covering happy path,
  invalid JSON, invalid timestamp, missing event_id/device_id, out-of-range
  lat/lon, empty/oversized batch, store errors, and idempotency (single + batch).
- internal/api/query_test.go: 14 handler tests covering missing query params
  (400) and empty-result-is-array guarantees for all four query endpoints.
- internal/auth/auth_test.go: 5 unit tests for HashPassword / VerifyPassword
  (correct password, wrong password, empty password, malformed hash, salt
  uniqueness).
- internal/db/trackpoints_test.go: 6 unit tests for the validateTrackpoint
  helper (happy path, missing fields, coordinate bounds, invalid source).
- .gitea/workflows/deploy.yml: add "Test" step (go test ./...) before
  "Build & Deploy" so a failing test aborts the deployment.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

backend/internal/api/query.go

@@ -9,7 +9,7 @@ import (
 )
 
 // HandleListDays handles GET /v1/days?from=YYYY-MM-DD&to=YYYY-MM-DD
-func HandleListDays(store *db.TrackpointStore) http.HandlerFunc {
+func HandleListDays(store db.TrackpointStorer) http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
 		userID := userIDFromContext(r.Context())
 		from := r.URL.Query().Get("from")
@@ -33,7 +33,7 @@ func HandleListDays(store *db.TrackpointStore) http.HandlerFunc {
 }
 
 // HandleListTrackpoints handles GET /v1/trackpoints?date=YYYY-MM-DD
-func HandleListTrackpoints(store *db.TrackpointStore) http.HandlerFunc {
+func HandleListTrackpoints(store db.TrackpointStorer) http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
 		userID := userIDFromContext(r.Context())
 		date := r.URL.Query().Get("date")
@@ -56,7 +56,7 @@ func HandleListTrackpoints(store *db.TrackpointStore) http.HandlerFunc {
 }
 
 // HandleListStops handles GET /v1/stops?date=YYYY-MM-DD
-func HandleListStops(store *db.StopStore) http.HandlerFunc {
+func HandleListStops(store db.StopStorer) http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
 		userID := userIDFromContext(r.Context())
 		date := r.URL.Query().Get("date")
@@ -79,7 +79,7 @@ func HandleListStops(store *db.StopStore) http.HandlerFunc {
 }
 
 // HandleListSuggestions handles GET /v1/suggestions?date=YYYY-MM-DD
-func HandleListSuggestions(store *db.SuggestionStore) http.HandlerFunc {
+func HandleListSuggestions(store db.SuggestionStorer) http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
 		userID := userIDFromContext(r.Context())
 		date := r.URL.Query().Get("date")