ci: run unit, integration and UI tests as parallel jobs

Split the heavy test suites out of the check job so coverage, MariaDB/Redis
integration and Playwright UI tests run concurrently on the host runner
(capacity raised to 4) instead of back-to-back (~2min wall-time saving).
Deploy and preflight now gate on all three test jobs.

.gitea/workflows/ci.yaml

@@ -16,11 +16,10 @@ env:
 
 jobs:
   # ─────────────────────────────────────────────
-  # Lint, typecheck & unit tests
-  # Draait op de host (self-hosted) waar Node 26 +
-  # pnpm 11 geïnstalleerd zijn en internet beschikbaar is.
-  # De job-container (docker mode) heeft GEEN outbound
-  # internet, dus we draaien alles direct op de host.
+  # Fast quality gate: toolchain, install, dependabot audit,
+  # lint, i18n contracts & typecheck. No heavy test suites here.
+  # Draait op de host (self-hosted) waar Node 26 + pnpm 11
+  # geïnstalleerd zijn en internet beschikbaar is.
   # ─────────────────────────────────────────────
   check:
     runs-on: self-hosted
@@ -49,7 +48,25 @@ jobs:
       - name: Typecheck
         run: pnpm typecheck
 
-      - name: Test
+  # ─────────────────────────────────────────────
+  # Test suites. Parallel jobs (host runner capacity >= 3) so unit,
+  # integration and UI tests each get a worker instead of running
+  # back-to-back inside the check job (~2min wall-time saving).
+  # ─────────────────────────────────────────────
+  tests-unit:
+    needs: check
+    runs-on: self-hosted
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          repository: ${{ gitea.repository }}
+          token: ${{ gitea.token }}
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Unit & coverage tests
         env:
           SKIP_ENV_VALIDATION: 1
           NODE_ENV: test
@@ -64,9 +81,35 @@ jobs:
             time pnpm test:coverage --maxWorkers=4
           fi
 
+  tests-integration:
+    needs: check
+    runs-on: self-hosted
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          repository: ${{ gitea.repository }}
+          token: ${{ gitea.token }}
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+
       - name: MariaDB and Redis integration tests
         run: pnpm test:integration
 
+  tests-ui:
+    needs: check
+    runs-on: self-hosted
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          repository: ${{ gitea.repository }}
+          token: ${{ gitea.token }}
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+
       # Compare against reviewed Linux references; updates are explicit.
       - name: Install UI test browser
         run: pnpm exec playwright install chromium
@@ -87,7 +130,7 @@ jobs:
 
   # Validate branch/PR Docker images before integration into a deployment branch.
   preflight:
-    needs: check
+    needs: [tests-unit, tests-integration, tests-ui]
     if: gitea.event_name == 'pull_request' || (gitea.event_name == 'push' && startsWith(gitea.ref, 'refs/heads/codex/'))
     runs-on: self-hosted
     steps:
@@ -121,7 +164,7 @@ jobs:
   # toegang heeft tot de daemon en volumes.
   # ─────────────────────────────────────────────
   deploy:
-    needs: check
+    needs: [tests-unit, tests-integration, tests-ui]
     if: gitea.event_name == 'push' && (gitea.ref_name == 'main' || gitea.ref_name == 'master')
     runs-on: self-hosted
     steps: