Add a Postgres test harness and a two-backend CI matrix

Testcontainers locally, a service container in CI, and a per-test-file
database so the 19 db-touching suites cannot see each other's rows.

The matrix exists because we ship two backends: a SQLite driver that CI never
exercises would drift from the Postgres one, and dialect drift is the bug
class that loses data.

Locally, the only container runtime available is rootless Podman (no docker
binary), so pg-global.js points DOCKER_HOST at the Podman socket and disables
Ryuk when the developer hasn't already set either - Testcontainers then works
unmodified on Docker or Podman. Ryuk's absence makes teardown() the only
thing that stops/removes the container; StartedTestContainer#stop() removes
volumes too, so no reaper is required as long as teardown runs.

No Postgres driver exists yet (that's Task 4), so tests/harness.test.js is
the only suite that actually exercises TEST_DATABASE_URL right now - the
other 452 tests hardcode DB_PATH=':memory:' and keep running against SQLite
regardless of TEST_BACKEND.

Author: Evan Phyillaier

.github/workflows/test.yml

@@ -0,0 +1,30 @@
+name: Tests
+on: [push, pull_request]
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        backend: [pg, sqlite]
+    services:
+      postgres:
+        image: postgres:16
+        env:
+          POSTGRES_PASSWORD: postgres
+          POSTGRES_USER: postgres
+          POSTGRES_DB: postgres
+        ports: ['5432:5432']
+        options: >-
+          --health-cmd pg_isready --health-interval 10s
+          --health-timeout 5s --health-retries 5
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 20
+      - run: npm ci
+      - run: npm test
+        env:
+          TEST_BACKEND: ${{ matrix.backend }}
+          TEST_DATABASE_URL: postgresql://postgres:postgres@localhost:5432/postgres

README.md

@@ -175,6 +175,46 @@ npm run dev
 
 Visit the client dev server's printed URL (usually `http://localhost:5173`).
 
+## Running the tests
+
+```bash
+npm test          # Postgres backend (default) - boots a throwaway container
+npm run test:sqlite   # SQLite backend, no container needed
+npm run test:all      # both, sqlite then pg
+```
+
+The Postgres backend needs a container runtime that speaks the Docker API.
+`tests/setup/pg-global.js` boots one shared Postgres 16 container via
+[Testcontainers](https://node.testcontainers.org) and each test file carves
+out its own database from it (`tests/helpers/backend.js`), so files can't
+see each other's rows.
+
+- **Docker**: works out of the box, nothing to configure.
+- **Podman** (what this repo's containers were validated against; no
+  `docker` binary required): start the user socket once per login session
+  and Testcontainers will find it automatically -
+  `tests/setup/pg-global.js` points `DOCKER_HOST` at the Podman socket
+  itself if `DOCKER_HOST` isn't already set, so no per-developer config is
+  needed:
+
+  ```bash
+  systemctl --user start podman.socket
+  ```
+
+  Rootless Podman can't grant Testcontainers' Ryuk reaper the privileges it
+  wants, so the harness also sets `TESTCONTAINERS_RYUK_DISABLED=true` by
+  default when using Podman. With Ryuk off, the container is stopped and
+  removed by `teardown()` in `pg-global.js` at the end of the run instead -
+  if a run is killed hard enough to skip that (e.g. `SIGKILL`), clean up any
+  leftovers with `podman ps -a` / `podman rm -f`.
+- **CI** sets `TEST_DATABASE_URL` directly against a Postgres service
+  container (see `.github/workflows/test.yml`) and never touches
+  Testcontainers at all.
+
+To point manually at a different runtime or disable Ryuk yourself, set
+`DOCKER_HOST` and/or `TESTCONTAINERS_RYUK_DISABLED` before running the
+tests - the harness only fills these in when they're unset.
+
 ## Live Events
 
 At most one event is active globally at a time. Each is a set of tunable