fix(ci): run ai_credits tests via buildx build, not runtime apt-get/docker run -v

The bare bookworm runner image has no apt-get/package manager at all
(the earlier build-essential install attempt failed with 'apt-get:
command not found'), and a plain 'docker run -v $PWD:/workspace'
wouldn't work either - DOCKER_HOST points at the sibling dind engine
(same nested-container setup build.yaml's own comments describe), so a
bind mount would look for the path on the wrong filesystem.

Matches build.yaml's actual working pattern instead: docker buildx
build with context transfer (not a volume mount), using a Dockerfile
(Dockerfile.test) whose RUN step runs the test suite and fails the
build on a non-zero exit. TEST_DATABASE_URL passed via buildx --secret
(not --build-arg) so it never lands in image layer history.

Isolated this by testing each piece of the original workflow
independently (env/secrets, id+GITHUB_OUTPUT, if: conditionals all
checked out fine one at a time) until apt-get was confirmed as the
actual failure point.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

.forgejo/workflows/test.yaml

@@ -37,7 +37,7 @@ jobs:
           fi
 
           run=false
-          if echo "$CHANGED_FILES" | grep -Eq '^(crates/db/|Cargo\.toml|Cargo\.lock|\.forgejo/workflows/test\.yaml)'; then
+          if echo "$CHANGED_FILES" | grep -Eq '^(crates/db/|Cargo\.toml|Cargo\.lock|Dockerfile\.test|\.forgejo/workflows/test\.yaml)'; then
             run=true
           fi
           echo "run=$run" >> "$GITHUB_OUTPUT"
@@ -45,17 +45,43 @@ jobs:
             echo "No changes relevant to crates/db - skipping integration tests."
           fi
 
-      - name: Debug echo after check
+      - name: Verify TEST_DATABASE_URL is configured
-        run: echo "check.outputs.run was ${{ steps.check.outputs.run }}"
-
-      - name: Debug conditional step
         if: steps.check.outputs.run == 'true'
-        run: echo "conditional step ran"
+        run: |
+          test -n "${TEST_DATABASE_URL:-}" || { echo "TEST_DATABASE_URL secret is not set - see docs/LIVE_SERVER_RUNBOOK.md step 6"; exit 1; }
 
-      - name: Debug apt-get
+      - name: Point DOCKER_HOST at this container's own gateway
         if: steps.check.outputs.run == 'true'
         run: |
           set -euo pipefail
-          apt-get update -qq
+          # Same trick build.yaml uses: this job container is nested one level
-          apt-get install -y -qq build-essential pkg-config
+          # inside the runner pod's dind sidecar, so its own loopback isn't the
-          echo "apt-get done, cc: $(which cc)"
+          # sidecar's - read the container's actual default-route gateway
+          # directly from /proc/net/route instead of relying on `ip`/`route`.
+          GATEWAY="$(awk '$2 == "00000000" {print $3}' /proc/net/route | head -1 | \
+            sed -E 's/(..)(..)(..)(..)/0x\4 0x\3 0x\2 0x\1/' | \
+            { read -r a b c d; printf '%d.%d.%d.%d' "$a" "$b" "$c" "$d"; })"
+          echo "Detected docker host gateway: $GATEWAY"
+          echo "DOCKER_HOST=tcp://$GATEWAY:2375" >> "$GITHUB_ENV"
+
+      - name: Set up Docker Buildx
+        if: steps.check.outputs.run == 'true'
+        run: |
+          set -euo pipefail
+          docker version
+          docker buildx create --use --name nxtgauge-builder || docker buildx use nxtgauge-builder
+          docker buildx inspect --bootstrap
+
+      - name: Run ai_credits integration tests
+        if: steps.check.outputs.run == 'true'
+        run: |
+          set -euo pipefail
+          # Build context transfer (not a bind mount) is what makes this work
+          # despite the nested dind setup - same reason build.yaml uses
+          # buildx rather than plain `docker run -v`. The Dockerfile's RUN
+          # step is the actual test; a non-zero exit fails this build (and
+          # this workflow step) the same way a failed `cargo test` would.
+          docker buildx build \
+            --secret id=test_db_url,env=TEST_DATABASE_URL \
+            -f Dockerfile.test \
+            .

Dockerfile.test

@@ -0,0 +1,13 @@
+# Runs crates/db's Postgres-backed integration tests as a build step.
+# Not published anywhere - build.yaml's DOCKER_HOST/buildx setup builds this
+# ad-hoc and discards the image; only whether the RUN step exits 0 matters.
+# TEST_DATABASE_URL is passed as a buildx secret (not a build-arg) so it
+# never lands in the image's layer history/cache metadata.
+FROM rust:1-bookworm
+
+WORKDIR /workspace
+COPY . .
+
+RUN --mount=type=secret,id=test_db_url,required=true \
+    export TEST_DATABASE_URL="$(cat /run/secrets/test_db_url)" && \
+    cargo test -p db --test ai_credits --test ai_credits_reaper -- --test-threads=1