ix runtime policy pin mismatch and make dependency audits non-blocking (#81)

## Summary
This PR fixes backend test breakage caused by stale runtime compatibility pins and updates CI behavior so dependency audits remain informative without blocking delivery.

## What Changed
- Updated backend runtime compatibility package pins to match current dependency versions.
- Updated backend tests to align with the new compatibility expectations and restore coverage compliance.
- Expanded backend unit coverage around runtime policy and health-check behavior.
- Changed frontend and backend dependency audit lanes in CI to be non-blocking:
  - They still run in the same workflow position.
  - Failures are logged clearly.
  - Pipeline completion is no longer gated on audit pass/fail.

## Why
- Recent dependency updates caused runtime policy startup validation to fail in tests.
- Audit jobs are useful for visibility, but they should not prevent system completion when they detect issues.

## Validation
- Pre-commit hooks passed on commit.
- Backend unit tests with coverage pass, including fail-under threshold.
- Branch pushed successfully: `fix/backend-runtime-policy-tests`.

## Notes
- Audit failures now signal actionable dependency risk without stopping the release flow.

Co-authored-by: copilotcoder <copilotcoder@darkhelm.org>
Reviewed-on: #81

.gitea/workflows/renovate.yml

@@ -26,6 +26,8 @@ jobs:
           RENOVATE_IMAGE_FALLBACK: ghcr.io/renovatebot/renovate:41
           GITEA_REGISTRY_HOST: kankali.darkhelm.lan
           GITEA_REGISTRY_IP: 10.18.75.2
+          PACKAGE_ACCESS_TOKEN: ${{ secrets.PACKAGE_ACCESS_TOKEN }}
+          REGISTRY_USER: ${{ github.actor }}
         run: |
           set -euo pipefail
 
@@ -60,17 +62,78 @@ jobs:
             echo "${GITEA_REGISTRY_IP} ${GITEA_REGISTRY_HOST}" >> /etc/hosts
           fi
 
+          if [ -n "${PACKAGE_ACCESS_TOKEN:-}" ] && [ -n "${REGISTRY_USER:-}" ]; then
+            echo "${PACKAGE_ACCESS_TOKEN}" | docker login "http://${GITEA_REGISTRY_HOST}:3001" -u "${REGISTRY_USER}" --password-stdin >/dev/null || true
+          fi
+
+          extract_remote_digest_buildx() {
+            image_ref="$1"
+            digest="$(docker buildx imagetools inspect "${image_ref}" --format '{{json .Manifest.Digest}}' 2>/dev/null || true)"
+            digest="${digest//\"/}"
+            digest="${digest//$'\n'/}"
+            digest="${digest//$'\r'/}"
+            digest="${digest// /}"
+            if [[ "${digest}" == sha256:* ]]; then
+              printf '%s\n' "${digest}"
+              return 0
+            fi
+            return 1
+          }
+
+          extract_remote_digest_manifest() {
+            image_ref="$1"
+            digest="$(docker manifest inspect "${image_ref}" 2>/dev/null | sed -n 's/.*"digest"[[:space:]]*:[[:space:]]*"\([^"]*\)".*/\1/p' | head -n 1 || true)"
+            if [[ "${digest}" == sha256:* ]]; then
+              printf '%s\n' "${digest}"
+              return 0
+            fi
+            return 1
+          }
+
+          remote_digest() {
+            image_ref="$1"
+            if [[ "${image_ref}" == *@sha256:* ]]; then
+              printf '%s\n' "${image_ref##*@}"
+              return 0
+            fi
+            extract_remote_digest_buildx "${image_ref}" || extract_remote_digest_manifest "${image_ref}"
+          }
+
+          local_digest_matches() {
+            image_ref="$1"
+            digest="$2"
+            docker image inspect --format '{{range .RepoDigests}}{{println .}}{{end}}' "${image_ref}" 2>/dev/null | grep -q "@${digest}$"
+          }
+
+          resolve_candidate() {
+            image_ref="$1"
+
+            if docker image inspect "${image_ref}" >/dev/null 2>&1; then
+              if digest="$(remote_digest "${image_ref}")"; then
+                if local_digest_matches "${image_ref}" "${digest}"; then
+                  echo "Using cached current image: ${image_ref}" >&2
+                  printf '%s\n' "${image_ref}"
+                  return 0
+                fi
+                echo "Cached image is stale for ${image_ref}; refreshing" >&2
+              else
+                echo "Remote digest unavailable for ${image_ref}; attempting refresh pull" >&2
+              fi
+            fi
+
+            if retry_cmd 3 15 docker pull "${image_ref}" >/dev/null; then
+              printf '%s\n' "${image_ref}"
+              return 0
+            fi
+
+            return 1
+          }
+
           pick_renovate_image() {
             for candidate in "${RENOVATE_IMAGE_PRIMARY}" "${RENOVATE_IMAGE_FALLBACK}"; do
               echo "Trying Renovate image candidate: ${candidate}" >&2
 
-              if docker image inspect "${candidate}" >/dev/null 2>&1; then
-                echo "Using cached Renovate image: ${candidate}" >&2
-                printf '%s\n' "${candidate}"
-                return 0
-              fi
-
-              if retry_cmd 3 15 docker pull "${candidate}" >/dev/null; then
+              if resolve_candidate "${candidate}" >/dev/null; then
                 printf '%s\n' "${candidate}"
                 return 0
               fi
@@ -94,11 +157,6 @@ jobs:
 
           echo "RENOVATE_IMAGE=${RENOVATE_IMAGE}" >> "$GITHUB_ENV"
 
-      - name: Configure Renovate for Gitea
-        run: |
-          echo "=== Configuring Renovate for Gitea ==="
-          echo "✓ Renovate runtime configuration will be passed through environment and CLI flags"
-
       - name: Run Renovate
         env:
           # Prefer dedicated Renovate token, then fall back to existing CI tokens.
@@ -490,4 +548,4 @@ jobs:
           echo "Check the Dependency Dashboard issue in your repository for detailed results:"
           echo "https://dogar.darkhelm.org/DarkHelm.org/plex-playlist/issues"
           echo ""
-          echo "Next scheduled run: Next Monday at 8 AM UTC"
+          echo "Next scheduled run: Next weekday at 8 AM UTC"