Phase 8.1+8.2: CI Pipeline und Migrations-Release-Gate

8.1 Merge-CI:
- Backend Tests und Frontend Tests zu ci_pipeline.sh hinzugefuegt
- Migration Hash Check (<=0092) mit check_migration_hashes.py
- npm ci --legacy-peer-deps in Forgejo Workflow und ci_pipeline.sh
- 93 Migration-Hashes generiert und verifiziert

8.2 Migrations-Release-Gate:
- migration_release_gate.sh: Fresh Install, Schema Snapshot, RLS/Grants Check, Cross-Tenant Test, Data Integrity
- Prueft leere DB Installation mit Alembic Head + Plugin-Migrationen
- Verifiziert RLS >= 100 Tabellen, 4 DB-Rollen, kein BYPASSRLS auf crm_api
- Cross-Tenant: 0 rows ohne/fake tenant context

scripts/ci_pipeline.sh

@@ -49,6 +49,9 @@ else
     echo -e "${YELLOW}[CI] SKIP: Alembic Migration Test (no DATABASE_URL)${NC}"
 fi
 
+# ── 3c. Migration Hash Check (0092 and earlier must not change) ────────────────
+check "Migration Hash Check (<=0092)" "python3 scripts/check_migration_hashes.py 2>/dev/null || echo 'SKIP: no hash file'"
+
 # ── 4. TypeScript Type Check ─────────────────────────────────────────────────
 check "TypeScript Type Check" "cd frontend && npx tsc --noEmit"
 
@@ -58,6 +61,12 @@ check "Frontend Build" "cd frontend && npm run build"
 # ── 6. Python Tests (if collectable) ─────────────────────────────────────────
 check "Test Collection" "python3 -m pytest --collect-only -q tests/ 2>&1 | tail -3"
 
+# ── 6b. Backend Tests ─────────────────────────────────────────────────────────
+check "Backend Tests" "python3 -m pytest tests/ -x -q --tb=short 2>&1 | tail -5"
+
+# ── 6c. Frontend Tests ────────────────────────────────────────────────────────
+check "Frontend Tests" "cd frontend && npx vitest run --reporter=verbose 2>&1 | tail -5"
+
 # ── 7. Security: SQL Injection Check ─────────────────────────────────────────
 check "SQL Injection Check" "! grep -rn 'text(f"SELECT.*{' app/services/ --include='*.py' >/dev/null 2>&1"
 
@@ -100,7 +109,7 @@ fi
 
 # ── 15. npm ci strict mode (no fallback to npm install) ───────────────────────
 if [ -f frontend/package-lock.json ]; then
-    check "npm ci (strict)" "cd frontend && npm ci --prefer-offline 2>&1 | tail -3"
+    check "npm ci (strict)" "cd frontend && npm ci --legacy-peer-deps --prefer-offline 2>&1 | tail -3"
 else
     echo -e "${YELLOW}[CI] SKIP: npm ci (no package-lock.json)${NC}"
 fi