Add requirements traceability gate and Gitea pipelines

Ports JellyTau's traceability tooling to Rust, carrying across the bug it
was repaired for. That gate divided a traced count by frozen literal
denominators; the requirements file outgrew them and it reported 158%
coverage, so it could never fail its own threshold.

Two rules, both enforced by the extractor's own tests:

  - denominators parsed from docs/requirements.md at run time
  - coverage is |traced ∩ defined| / |defined|, never a raw traced count

The gate additionally fails hard on a misconfigured run — zero
requirements parsed or zero files scanned — rather than reporting a
plausible 0%, and on any orphan tag naming a requirement that does not
exist.

Adapted for DarkRoom: IDs are FR-CAT-1 / NFR-P13 / FR-DEV-3a shapes
rather than JellyTau's fixed three digits, and decisions (D), spikes (S),
milestone items (M) and test ids remain taggable while being excluded
from the denominator — counting them inflated it by 25.

Also adds dr-sync: the RemoteBackend trait and capability model, so the
Nextcloud connector is one implementation rather than the only shape the
engine understands. No mature Nextcloud crate exists (reqwest_dav is too
thin), so the connector will be hand-rolled over reqwest per D7.

Gitea workflows follow the same style: containerised, commented with the
reasoning, desktop and Android on every push, plus a CI check that no
core/ crate depends on the UI toolkit (ARCH §6.5a).

Coverage today: 13.3% (19/143). 50 tests passing.

.gitea/workflows/traceability-check.yml

@@ -0,0 +1,99 @@
+name: Traceability
+
+# Mirrors JellyTau's traceability gate, including the reason it exists.
+#
+# That gate divided a traced count by frozen literal denominators while the
+# requirements file grew past them, reported 158% coverage, and so could never
+# fail its own threshold. Two rules follow, and the extractor's own tests
+# enforce both:
+#
+#   1. Denominators are parsed from docs/requirements.md at run time.
+#   2. Coverage is |traced ∩ defined| / |defined|, never a raw traced count.
+#
+# This job is static analysis of source comments plus markdown parsing, so it
+# needs no GPU and no Android SDK — only the Rust toolchain.
+
+on:
+  push:
+    branches: [main, master, develop]
+  pull_request:
+    branches: [main, master, develop]
+
+jobs:
+  traceability:
+    runs-on: linux/amd64
+    name: Requirement traces
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Cache cargo
+        uses: actions/cache@v4
+        with:
+          path: |
+            ~/.cargo/registry
+            ~/.cargo/git
+            target
+          key: traces-${{ runner.os }}-${{ hashFiles('**/Cargo.lock') }}
+
+      # The gate's own arithmetic is the thing being trusted, so its tests run
+      # before it does. Untested gate logic is exactly how JellyTau's 158% went
+      # unnoticed for months.
+      - name: Test the extractor
+        run: cargo test -p traceability
+
+      # Structural failures are unconditional and do not depend on the coverage
+      # threshold: zero requirements parsed, zero files scanned, a ratio above
+      # 100%, or any orphan tag all fail the build. A misconfigured run must not
+      # report a plausible-looking 0%.
+      - name: Traceability gate
+        run: cargo run -q -p traceability -- check
+
+      - name: Regenerate matrix and check it is committed
+        run: |
+          set -e
+          cargo run -q -p traceability -- report
+          if ! git diff --quiet docs/traceability.md; then
+            echo ""
+            echo "docs/traceability.md is out of date."
+            echo "Run: cargo run -p traceability -- report"
+            git diff --stat docs/traceability.md
+            exit 1
+          fi
+
+      # Advisory, not blocking: not every file implements a requirement, and a
+      # tag on every function is noise that rots faster than it helps. Tag the
+      # unit that decides.
+      - name: Check changed files for tags
+        if: github.event_name == 'pull_request'
+        run: |
+          set -e
+          CHANGED=$(git diff --name-only "origin/${{ github.base_ref }}...HEAD" \
+                    | grep -E '\.(rs|slint|wgsl)$' || true)
+          [ -z "$CHANGED" ] && { echo "No source files changed."; exit 0; }
+
+          MISSING=0
+          for file in $CHANGED; do
+            case "$file" in
+              */tests/*|*/test_*|tools/*) continue ;;
+            esac
+            [ -f "$file" ] || continue
+            if ! grep -q 'TRACES:' "$file"; then
+              echo "   no TRACES tag: $file"
+              MISSING=$((MISSING + 1))
+            fi
+          done
+
+          if [ "$MISSING" -gt 0 ]; then
+            echo ""
+            echo "$MISSING changed file(s) carry no requirement tag."
+            echo "Format: /// TRACES: FR-CAT-1, FR-CAT-2 | NFR-P1"
+            echo "        (comma separates IDs, pipe groups types)"
+          fi
+
+      - name: Summary
+        if: always()
+        run: head -30 docs/traceability.md || true