test(tier1): docker compose stack (gitea seed + backend + web + mailpit)

Wires the four-service Tier-1 integration stack and brings it up green.

Fixes found during live bring-up:
- gitea-admin-init: run as user 'git'; the gitea CLI refuses to run as
  root and our custom entrypoint bypasses the image's s6 init that
  normally drops privileges.
- backend.Dockerfile: COPY VERSION to /VERSION; health.py reads the
  canonical VERSION file from the repo root (parents[2]) at import, so
  it must exist in the image or the backend crashes on startup.

env_file cold-start: generated/.env.tier1.generated is created as an
empty placeholder (gitignored) so the backend env_file path always
exists; the seeder overwrites it before backend starts.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

testing/backend.Dockerfile

@@ -7,6 +7,10 @@ COPY backend/requirements.txt /app/requirements.txt
 RUN pip install --no-cache-dir -r requirements.txt uvicorn
 
 COPY backend/ /app/
+# §20.1: health.py reads the canonical VERSION file from the repo root
+# (parents[2] of backend/app/health.py). In the image that resolves to
+# /VERSION, so the file must be copied there or backend import crashes.
+COPY VERSION /VERSION
 
 RUN mkdir -p /data
 EXPOSE 8000