ci(web): run the server suite before building the image

The build job now needs: test, so an image cannot be published with the suite in
red — which is the whole point of this phase. Both jobs live in the same file
because needs: only links jobs within one workflow.

settings-ci.json is committed and contains no secrets: settings-development.json
is gitignored, so CI had nothing to pass to --settings. The one test that cannot
work without a secret is the node-red iron fixture, sealed with the deployment's
own ironPassword; it now reports itself as skipped instead of failing on an hmac
mismatch, and still runs locally against settings-development.json.

Measured locally: 22s and a ~2.0 GB peak for the whole `meteor test` run (its own
mongod included), hence --memory=3g. The meteor-tool download is not cached yet;
the note in the workflow says what that would take.

settings-ci.json

@@ -0,0 +1,59 @@
+{
+  "gmaps": {
+    "key": "",
+    "serverKey": ""
+  },
+  "piwik": {
+    "url": "http://localhost:9/piwik.php",
+    "site_id": 1
+  },
+  "sentryPrivateDSN": "",
+  "public": {
+    "sentryPublicDSN": "",
+    "telegramAuth": 1
+  },
+  "private": {
+    "testEmail": "someone@example.com",
+    "testMailer": false,
+    "debugMailer": false,
+    "MAIL_URL": "smtp://127.0.0.1:1025/",
+    "// isMailServer": "See: https://github.com/VeliovGroup/Mail-Time",
+    "isMailServer": true,
+    "fireIconUrl": "https://testfuegos.comunes.org/fire-marker.png",
+    "OAuth": {
+      "google": {
+        "clientId": "",
+        "secret": "",
+        "loginStyle": "popup"
+      }
+    },
+    "fcmApiToken": "",
+    "proxies_count": 0,
+    "ironPassword": "SomePasswordAlLeast32LongYouKnowHowToCount",
+    "internalApiToken": "ci-smoke-token",
+    "cron": {
+      "debug": false
+    },
+    "twitter": {
+      "es": {
+        "enabled": false,
+        "comment": "using later.js",
+        "when": "at 9:15 am also at 3:15 pm also at 10:00 pm",
+        "consumer_key": "...",
+        "consumer_secret": "...",
+        "access_token": "...",
+        "access_token_secret": "..."
+      },
+      "en": {
+        "enabled": false,
+        "comment": "using later.js",
+        "when": "at 9:15 am also at 3:15 pm also at 10:00 pm",
+        "consumer_key": "...",
+        "consumer_secret": "...",
+        "access_token": "...",
+        "access_token_secret": "..."
+      }
+    }
+  },
+  "_comment": "Settings for CI (tests / smoke / e2e). No secrets: every value here is fake on purpose. See settings-development-sample.json for the shape."
+}