Run sigma-api integration tests in CI against Postgres + Redis

[lai3d]

Summary

• build-api.yml previously only ran docker buildx build for the API image. The integration tests added in Gate /api/ai/triage on admin or operator role #13–Audit-log /api/ai/triage requests #17 (RBAC for /api/ai/triage, per-user LLM rate limiting, audit logging) were compile-checked at best — and not even that, since the Docker build wasn't running cargo build against the test target. A regression in any of those security-sensitive paths would have merged green.
• Added a test-api job that runs before the Docker build, with postgres:16 and redis:7 as GitHub Actions service containers, health-checked and exposed on localhost:5432 / localhost:6379.
• Sets DATABASE_URL=postgres://sigma:sigma@localhost:5432/sigma_test and REDIS_URL=redis://localhost:6379 — matching what sigma-api/tests/common/mod.rs::setup_with_llm_limit reads. Migrations are run by the tests themselves via sqlx::migrate::Migrator::new("./migrations"), so the workflow just provides empty services.
• Runs cargo test -p sigma-api -- --test-threads=1. Single-threaded because every test calls setup() which TRUNCATEs shared tables and re-seeds the admin user — parallel runs would race on the shared DB.
• The existing build-api Docker job is preserved and now needs: test-api, so a red test suite blocks the image build.
• Added Swatinem/rust-cache@v2 scoped to sigma-api to keep the test job fast on subsequent runs.

Test plan

• CI green on this PR (the test-api job actually runs the integration suite, not just compiles it)
• build-api job still produces the API image after test-api passes
• Confirm in the Actions log that Postgres 16 + Redis 7 service containers come up healthy
• Confirm cargo test -p sigma-api output shows the ai_triage_test, audit_logs_test, auth_test, providers_test, tickets_test, and users_test targets executing

🤖 Generated with Claude Code