Fix CI DinD networking: host network mode + curl timeout

The previous fix (container IP resolution) still failed because the
CI runner and compose containers are on separate Docker networks.

- Add docker-compose.ci.yml override with network_mode: host so the
  container shares the runner's network stack directly
- Add --connect-timeout 2 to curl in wait-for-healthy.sh so it fails
  fast instead of hanging indefinitely on unreachable hosts
- Cap health check at 30s (server boots in 5-10s)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

.gitea/workflows/ci.yaml

@@ -385,42 +385,32 @@ jobs:
         uses: actions/checkout@v4
 
       - name: Build Docker image
-        run: docker compose build
+        run: docker compose -f docker-compose.yml -f docker-compose.ci.yml build
 
-      - name: Boot server (SQLite)
+      - name: Boot server (SQLite, host networking)
         env:
           BUNDLED_PACKAGES: '*'
           ARMATURE_ADMIN_USERNAME: admin
           ARMATURE_ADMIN_PASSWORD: admin
           ARMATURE_ADMIN_EMAIL: admin@test.local
-        run: docker compose up -d
+        run: docker compose -f docker-compose.yml -f docker-compose.ci.yml up -d
-
-      # In DinD (Gitea runner pods), port-mapped localhost doesn't reach
-      # the compose container.  Resolve the container IP on its Docker
-      # network so curl / Playwright can connect directly on port 80.
-      - name: Resolve container IP
-        id: container-ip
-        run: |
-          IP=$(docker inspect -f '{{range .NetworkSettings.Networks}}{{.IPAddress}}{{end}}' armature)
-          echo "SERVER_URL=http://${IP}:80" >> "$GITHUB_OUTPUT"
-          echo "Resolved container IP → ${IP}"
 
       - name: Wait for healthy
-        run: ./ci/wait-for-healthy.sh ${{ steps.container-ip.outputs.SERVER_URL }}
+        run: ./ci/wait-for-healthy.sh http://localhost:80 30
 
       - name: Install Playwright
         run: npx playwright install --with-deps chromium
 
       - name: Run surface tests
         env:
-          SERVER_URL: ${{ steps.container-ip.outputs.SERVER_URL }}
+          SERVER_URL: http://localhost:80
           ADMIN_USER: admin
           ADMIN_PASS: admin
         run: ./ci/run-surface-tests.sh
 
       - name: Teardown
         if: always()
-        run: docker compose down -v
+        run: docker compose -f docker-compose.yml -f docker-compose.ci.yml down -v
 
   # ── Stage 2: Build, Database, Deploy ─────────
   #

ci/wait-for-healthy.sh

@@ -10,7 +10,7 @@ MAX_RETRIES="${2:-60}"
 
 echo "Waiting for ${HOST} to be healthy..."
 for i in $(seq 1 "$MAX_RETRIES"); do
-  if curl -sf "${HOST}/api/v1/auth/login" -o /dev/null 2>/dev/null; then
+  if curl -sf --connect-timeout 2 "${HOST}/api/v1/auth/login" -o /dev/null 2>/dev/null; then
     echo "Server healthy after ${i}s"
     exit 0
   fi

docker-compose.ci.yml

@@ -0,0 +1,7 @@
+# CI override — uses host networking so the container is reachable
+# from the Gitea runner pod without cross-network routing.
+#
+# Usage: docker compose -f docker-compose.yml -f docker-compose.ci.yml up -d
+services:
+  armature:
+    network_mode: host