feat: add pr-comment step to post CI results on pull requests

Posts a formatted markdown comment with coverage percentage, commit SHA,
branch info, and pipeline link to the Gitea PR via API.
Uses GITEA_API_TOKEN secret from Woodpecker for authentication.

.woodpecker/pipeline.yml

@@ -115,3 +115,32 @@ steps:
       - uv run --no-sync coverage combine .coverage.unit .coverage.integration
       - uv run --no-sync coverage report --fail-under=70 --include=app/*
       - uv run --no-sync coverage html
+
+  - name: pr-comment
+    image: python:3.13
+    volumes:
+      - /tmp/uv-cache:/root/.cache/uv
+    environment:
+      UV_CACHE_DIR: /root/.cache/uv
+      UV_LINK_MODE: copy
+      UV_PYTHON: "3.13"
+      GITEA_API_TOKEN:
+        from_secret: gitea_api_token
+    depends_on: [coverage]
+    when:
+      event: [pull_request]
+    commands:
+      - pip install uv
+      - |
+        SHA7=$(printf '%.7s' "${CI_COMMIT_SHA:-unknown}")
+        SOURCE="${CI_COMMIT_SOURCE:-?}"
+        TARGET="${CI_COMMIT_TARGET:-?}"
+        PIPELINE_URL="${CI_PIPELINE_URL:-}"
+        COVER=$(uv run --no-sync coverage report --include='app/*' | tail -1 | awk '{print $NF}')
+        if [ -z "$GITEA_API_TOKEN" ]; then
+          echo "pr-comment: GITEA_API_TOKEN not set, skipping"
+          exit 0
+        fi
+        FMT='{"body": "## CI Results\n\n| Check | Result |\n|-------|--------|\n| Commit | `%s` |\n| Branch | %s -> %s |\n| Coverage | **%s** |\n| Pipeline | [View](%s) |\n\n---\n*Reported by @cicd*"}'
+        BODY=$(printf "$FMT" "$SHA7" "$SOURCE" "$TARGET" "$COVER" "$PIPELINE_URL")
+        curl -s -X POST "${CI_FORGE_URL}/api/v1/repos/${CI_REPO_OWNER}/${CI_REPO_NAME}/issues/${CI_COMMIT_PULL_REQUEST}/comments" -H "Authorization: token ${GITEA_API_TOKEN}" -H "Content-Type: application/json" --data-binary "$BODY"