test: migrate backend suites to pytest with module coverage gate

Split backend tests into unit and integration suites, add isolated fixtures and coverage enforcement, and update CI and test documentation. Cover current authentication, content, notification, payment, media, and admin flows; fix behaviors revealed by the new tests. Validate both suites and the per-module gate against local PostgreSQL.

apps/gallery/tests/integration/test_gallery.py

@@ -0,0 +1,49 @@
+import pytest
+from django.core.files.uploadedfile import SimpleUploadedFile
+
+from apps.gallery.models import Gallery
+
+
+pytestmark = [pytest.mark.integration, pytest.mark.django_db]
+
+
+def test_gallery_list_is_public_and_upload_requires_auth(client):
+    response = client.get("/api/gallery/images")
+    assert response.status_code == 200
+    assert response.json() == []
+    assert client.post("/api/gallery/images").status_code == 401
+
+
+def test_gallery_upload_visibility_update_delete_and_restore(client, user_factory, auth_headers, mocker, tmp_path, settings):
+    settings.MEDIA_ROOT = tmp_path
+    queued = mocker.patch("apps.gallery.api.views.process_uploaded_image.delay")
+    staff = user_factory(is_staff=True)
+    member = user_factory()
+    headers = auth_headers(staff)
+    denied = client.post("/api/gallery/images", {"file": SimpleUploadedFile("file.png", b"image", content_type="image/png")},
+                         **auth_headers(member))
+    assert denied.status_code == 400
+    invalid = client.post("/api/gallery/images", {"file": SimpleUploadedFile("file.txt", b"text", content_type="text/plain")}, **headers)
+    assert invalid.status_code == 400
+    uploaded = client.post("/api/gallery/images", {"file": SimpleUploadedFile("file.png", b"image", content_type="image/png")}, **headers)
+    assert uploaded.status_code == 201, uploaded.content
+    image = Gallery.objects.get(pk=uploaded.json()["id"])
+    queued.assert_called_once_with(image.pk)
+    assert client.get(f"/api/gallery/images/{image.pk}").status_code == 200
+    assert [row["id"] for row in client.get("/api/gallery/images").json()] == [image.pk]
+    assert client.put(f"/api/gallery/images/{image.pk}", data='{"title":"Blocked"}',
+                      content_type="application/json", **auth_headers(member)).status_code == 400
+    updated = client.put(f"/api/gallery/images/{image.pk}", data='{"title":"Private","is_public":false}',
+                         content_type="application/json", **headers)
+    assert updated.status_code == 200, updated.content
+    image.refresh_from_db()
+    assert image.title == "Private" and not image.is_public
+    assert client.get("/api/gallery/images").json() == []
+    assert client.get("/api/gallery/images", {"public_only": "false"}).json()[0]["id"] == image.pk
+    assert client.get(f"/api/gallery/images/{image.pk}").status_code == 404
+    assert client.delete(f"/api/gallery/images/{image.pk}", **headers).status_code == 200
+    assert Gallery.deleted_objects.filter(pk=image.pk).exists()
+    assert client.get("/api/gallery/deleted/images", **auth_headers(member)).status_code == 403
+    assert client.get("/api/gallery/deleted/images", **headers).json()[0]["id"] == image.pk
+    assert client.post(f"/api/gallery/deleted/images/{image.pk}/restore", **headers).status_code == 200
+    assert Gallery.objects.filter(pk=image.pk).exists()