CI: run the test suite inside the built image (#3)

.forgejo/workflows/build.yml

@@ -39,3 +39,18 @@ jobs:
 
       - name: Build
         run: docker build -t thermograph-frontend:ci .
+
+      # Run the hermetic unit tier INSIDE the image we just built (it ships
+      # tests/ + all runtime deps via COPY . /app/): fixture-backed rendering
+      # tests, no backend, no network. The integration tier
+      # (tests/integration/, needs a live backend container) stays a local
+      # `make`/scripts concern -- see scripts/backend-for-tests.sh.
+      # requirements-dev.txt only layers pytest on top, so the install is tiny.
+      # -u 0: the image's default user can't write to site-packages.
+      # unset THERMOGRAPH_BASE: the image bakes the prod root-mount; the tests
+      # expect the app default (/thermograph), same rationale as the backend.
+      - name: Run unit tests in the built image
+        run: |
+          docker run --rm -u 0 thermograph-frontend:ci \
+            sh -c "unset THERMOGRAPH_BASE; pip install -q --no-cache-dir pytest==8.4.1 && python -m pytest tests/unit -q"
+