Add pytest suite and gate Docker publishing

[Skulldorom]

Summary

• Add a pytest suite covering FreshRSS env validation, health endpoint behavior, token login/caching failures, unread feed shaping, category scoping, missing timestamps/URLs, and upstream request failures.
• Gate Docker publishing behind a required test job in GitHub Actions.
• Run tests on pull requests, while only building/pushing GHCR images for pushes to main after tests pass.
• Document local test commands and exclude tests/ from the Docker build context.

Validation

• uv sync --frozen && uv run pytest -q → 9 passed in 0.22s
• README/workflow sanity check → README and workflow sanity checks passed
• docker build --progress=plain -t rss-api-test-gate . → passed, image built as rss-api-test-gate

Notes

The tests exposed and fixed a few real edge cases while being added:

• FreshRSS login request exceptions now return a 502 instead of bubbling raw requests exceptions.
• FreshRSS unread request exceptions now return a 502 instead of bubbling raw upstream errors.
• Empty/missing alternate arrays no longer raise IndexError.
• Direct unit calls no longer treat FastAPI's Query(...) default object as a category label.