Fix CI DinD networking: replace host mode with compose-internal Playwright

The test-runners job was failing because network_mode: host puts the
armature container on DinD's network namespace, unreachable from the
workflow container which is on a separate bridge network.

Fix: Remove host networking entirely. Add a test-runner service to the
CI compose override that runs Playwright tests on the same bridge
network as armature, using Docker DNS (http://armature:80).

Changes:
- docker-compose.ci.yml: Replace network_mode: host with healthcheck
  on armature + Playwright test-runner service (depends_on: healthy)
- ci.yaml: Collapse 7 test-runners steps into 3 (checkout, compose
  up --exit-code-from test-runner, teardown)

.gitea/workflows/ci.yaml

@@ -384,29 +384,16 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v4
 
-      - name: Build Docker image
-        run: docker compose -f docker-compose.yml -f docker-compose.ci.yml build
-
-      - name: Boot server (SQLite, host networking)
+      - name: Run surface tests (compose)
         env:
           BUNDLED_PACKAGES: '*'
           ARMATURE_ADMIN_USERNAME: admin
           ARMATURE_ADMIN_PASSWORD: admin
           ARMATURE_ADMIN_EMAIL: admin@test.local
-        run: docker compose -f docker-compose.yml -f docker-compose.ci.yml up -d
-
-      - name: Wait for healthy
-        run: ./ci/wait-for-healthy.sh http://localhost:80 30
-
-      - name: Install Playwright
-        run: npx playwright install --with-deps chromium
-
-      - name: Run surface tests
-        env:
-          SERVER_URL: http://localhost:80
-          ADMIN_USER: admin
-          ADMIN_PASS: admin
-        run: ./ci/run-surface-tests.sh
+        run: |
+          docker compose -f docker-compose.yml -f docker-compose.ci.yml up --build \
+            --abort-on-container-exit \
+            --exit-code-from test-runner
 
       - name: Teardown
         if: always()