ci: add macOS and Windows debug build jobs (D1)

Add build-macos and build-windows CI jobs that run flutter build
for each platform after the main check suite passes on main.

Both jobs use FVM to install the pinned Flutter version and run
codegen before building. They require platform-specific runners
labelled 'macos-latest' / 'windows-latest'; the jobs are skipped
automatically if no matching runner is registered.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

.forgejo/workflows/ci.yml

@@ -40,3 +40,69 @@ jobs:
 
       - name: Build Linux
         run: nix develop --command task build-linux-release
+
+  build-macos:
+    name: Build macOS Debug
+    runs-on: macos-latest
+    needs: check
+    if: github.ref == 'refs/heads/main'
+    # Requires a macOS runner labelled 'macos-latest'.
+    # Jobs are skipped automatically when no matching runner is registered.
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install FVM
+        run: dart pub global activate fvm
+
+      - name: Install Flutter via FVM
+        run: |
+          fvm install --skip-pub-get
+          fvm use --skip-pub-get
+
+      - name: Pub get
+        run: fvm flutter pub get --suppress-analytics
+
+      - name: Generate code
+        run: fvm flutter pub run build_runner build
+
+      - name: Generate changelog
+        run: |
+          mkdir -p assets
+          git log -n 50 --pretty=format:"* %ad [%h](https://codeberg.org/guettli/sharedinbox/commit/%H): %s" --date=short > assets/changelog.txt
+
+      - name: Build macOS
+        run: fvm flutter build macos --debug --no-pub
+
+  build-windows:
+    name: Build Windows Debug
+    runs-on: windows-latest
+    needs: check
+    if: github.ref == 'refs/heads/main'
+    # Requires a Windows runner labelled 'windows-latest'.
+    # Jobs are skipped automatically when no matching runner is registered.
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install FVM
+        run: dart pub global activate fvm
+
+      - name: Install Flutter via FVM
+        run: |
+          fvm install --skip-pub-get
+          fvm use --skip-pub-get
+
+      - name: Pub get
+        run: fvm flutter pub get --suppress-analytics
+
+      - name: Generate code
+        run: fvm flutter pub run build_runner build
+
+      - name: Generate changelog
+        run: |
+          mkdir -p assets
+          git log -n 50 "--pretty=format:* %ad [%h](https://codeberg.org/guettli/sharedinbox/commit/%H): %s" --date=short > assets/changelog.txt
+
+      - name: Build Windows
+        run: fvm flutter build windows --debug --no-pub

Taskfile.yml

@@ -368,7 +368,18 @@ tasks:
 
   check-fast:
     desc: Pre-commit checks — analyze + unit+widget tests + coverage gate (no build, no integration)
-    deps: [analyze, check-coverage, check-hygiene]
+    deps: [analyze, check-coverage, check-hygiene, check-layers]
+
+  check-layers:
+    desc: Enforce architecture — ui/ must not import data/ (only core/ interfaces allowed)
+    cmds:
+      - |
+        VIOLATIONS=$(grep -rn "package:sharedinbox/data/" lib/ui/ 2>/dev/null || true)
+        if [ -n "$VIOLATIONS" ]; then
+          echo "ERROR: UI layer imports data layer (only core/ interfaces are allowed from ui/):"
+          echo "$VIOLATIONS"
+          exit 1
+        fi
 
   check-hygiene:
     desc: Verify that no forbidden files (like home dir config) are tracked