Wire live-test credentials into CI from Actions secrets

The integration step now receives the LLM and Matrix env vars from
repo secrets, so the live smoke tests run in CI when the runner can
reach the services; the skip-guards keep a missing secret or
unreachable service as a skip, never a failure. -rs surfaces skip
reasons in the CI log for diagnosis.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

.gitea/workflows/ci.yml

@@ -27,4 +27,15 @@ jobs:
         run: uv run pytest -m "not integration"
 
       - name: Integration tests
-        run: uv run pytest -m integration
+        # Live-path credentials come from repo Actions secrets; the tests
+        # skip-guard on these, so a missing secret or unreachable service
+        # degrades to "skipped", never a failure on unrelated work.
+        env:
+          NISSE_LLM_BASE_URL: ${{ secrets.NISSE_LLM_BASE_URL }}
+          NISSE_LLM_TOKEN: ${{ secrets.NISSE_LLM_TOKEN }}
+          NISSE_ROLE_EXECUTOR: ${{ secrets.NISSE_ROLE_EXECUTOR }}
+          NISSE_MATRIX_HOMESERVER: ${{ secrets.NISSE_MATRIX_HOMESERVER }}
+          NISSE_MATRIX_USER_ID: ${{ secrets.NISSE_MATRIX_USER_ID }}
+          NISSE_MATRIX_TOKEN: ${{ secrets.NISSE_MATRIX_TOKEN }}
+          NISSE_MATRIX_TEST_ROOM_ID: ${{ secrets.NISSE_MATRIX_TEST_ROOM_ID }}
+        run: uv run pytest -m integration -rs