Add requirements traceability gate and Gitea pipelines

Ports JellyTau's traceability tooling to Rust, carrying across the bug it
was repaired for. That gate divided a traced count by frozen literal
denominators; the requirements file outgrew them and it reported 158%
coverage, so it could never fail its own threshold.

Two rules, both enforced by the extractor's own tests:

  - denominators parsed from docs/requirements.md at run time
  - coverage is |traced ∩ defined| / |defined|, never a raw traced count

The gate additionally fails hard on a misconfigured run — zero
requirements parsed or zero files scanned — rather than reporting a
plausible 0%, and on any orphan tag naming a requirement that does not
exist.

Adapted for DarkRoom: IDs are FR-CAT-1 / NFR-P13 / FR-DEV-3a shapes
rather than JellyTau's fixed three digits, and decisions (D), spikes (S),
milestone items (M) and test ids remain taggable while being excluded
from the denominator — counting them inflated it by 25.

Also adds dr-sync: the RemoteBackend trait and capability model, so the
Nextcloud connector is one implementation rather than the only shape the
engine understands. No mature Nextcloud crate exists (reqwest_dav is too
thin), so the connector will be hand-rolled over reqwest per D7.

Gitea workflows follow the same style: containerised, commented with the
reasoning, desktop and Android on every push, plus a CI check that no
core/ crate depends on the UI toolkit (ARCH §6.5a).

Coverage today: 13.3% (19/143). 50 tests passing.

Cargo.toml

@@ -3,8 +3,10 @@ resolver = "2"
 members = [
     "core/dr-types",
     "core/dr-gpu",
+    "core/dr-sync",
     "ui/dr-ui",
     "apps/darkroom-desktop",
+    "tools/traceability",
 ]
 
 [workspace.package]
@@ -18,6 +20,7 @@ repository = "https://github.com/dtourolle/DarkRoom"
 # Internal
 dr-types = { path = "core/dr-types" }
 dr-gpu = { path = "core/dr-gpu" }
+dr-sync = { path = "core/dr-sync" }
 dr-ui = { path = "ui/dr-ui" }
 
 # GPU + UI
@@ -31,6 +34,17 @@ thiserror = "2"
 log = "0.4"
 env_logger = "0.11"
 pollster = "0.4"
+
+# Networking — no mature Nextcloud crate exists; the connector is hand-rolled
+# over reqwest (D7). reqwest_dav was evaluated and is too thin to build on.
+reqwest = { version = "0.13", default-features = false, features = ["rustls-tls", "stream", "json"] }
+quick-xml = "0.41"
+tokio = { version = "1", features = ["rt-multi-thread", "macros", "sync", "time"] }
+url = "2.5"
+async-trait = "0.1"
+serde = { version = "1", features = ["derive"] }
+serde_json = "1"
+base64 = "0.23"
 bytemuck = { version = "1", features = ["derive"] }
 
 [profile.dev]