The OCR integration tests self-skip without the tesseract binary. Debian's tesseract reads the synthetic receipt dates differently than the brew build (2023 -> 2028), so keep those tests local-only for now.
Adds .gitea/workflows/ci.yml (python-ci with tesseract + libgl for the OCR/opencv tests, plus gitleaks secret-scan) and ruff.toml (E4/E7/E9/F/I, line-length 120). Cleans up the remaining unused-variable findings so the lint gate is green.