chore: establish Ekklesia platform foundation

tests/infrastructure.test.ts

@@ -0,0 +1,61 @@
+import { readFile } from "node:fs/promises";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import { describe, expect, it } from "vitest";
+import { parse } from "yaml";
+
+interface ComposeService {
+  healthcheck?: unknown;
+  image?: string;
+  ports?: string[];
+  volumes?: string[];
+}
+
+interface ComposeDocument {
+  services?: Record<string, ComposeService>;
+  volumes?: Record<string, unknown>;
+}
+
+const repositoryRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
+
+describe("development infrastructure", () => {
+  it("has valid, local-only, version-pinned Compose services", async () => {
+    const source = await readFile(
+      path.join(repositoryRoot, "infrastructure", "compose.yaml"),
+      "utf8",
+    );
+    const compose = parse(source) as ComposeDocument;
+    const postgres = compose.services?.postgres;
+    const objectStorage = compose.services?.["object-storage"];
+
+    expect(postgres?.image).toBe("postgres:18.4-alpine3.24");
+    expect(objectStorage?.image).toBe("chrislusf/seaweedfs:4.28");
+    expect(postgres?.healthcheck).toBeDefined();
+    expect(objectStorage?.healthcheck).toBeDefined();
+
+    for (const service of [postgres, objectStorage]) {
+      expect(service).toBeDefined();
+      expect(service?.image).not.toMatch(/:latest$/u);
+      expect(service?.ports?.every((port) => port.startsWith("127.0.0.1:"))).toBe(true);
+      expect(service?.volumes?.length).toBeGreaterThan(0);
+    }
+
+    expect(compose.volumes).toHaveProperty("postgres-data");
+    expect(compose.volumes).toHaveProperty("object-storage-data");
+  });
+
+  it("has a parseable CI workflow with a single repository gate", async () => {
+    const source = await readFile(
+      path.join(repositoryRoot, ".github", "workflows", "ci.yml"),
+      "utf8",
+    );
+    const workflow = parse(source) as {
+      jobs?: { verify?: { steps?: Array<{ run?: string }> } };
+    };
+    const commands = workflow.jobs?.verify?.steps?.flatMap((step) => step.run ?? []) ?? [];
+
+    expect(workflow.jobs?.verify).toBeDefined();
+    expect(commands).toContain("pnpm install --frozen-lockfile");
+    expect(commands).toContain("pnpm ci");
+  });
+});