Add comprehensive E2E tests for materia CLI

- Add pytest and pytest-cov for testing
- Add niquests for modern HTTP/2 support (keep requests for hcloud compatibility)
- Create 13 E2E tests covering CLI, workers, pipelines, and secrets (71% coverage)
- Fix Pulumi ESC environment path (beanflows/prod) and secret key names
- Update GitLab CI to run CLI tests with coverage reporting

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

tests/conftest.py

@@ -0,0 +1,99 @@
+"""Pytest configuration and fixtures."""
+
+import os
+import pytest
+from unittest.mock import Mock, patch
+
+
+@pytest.fixture
+def mock_esc_env(tmp_path):
+    """Mock Pulumi ESC environment variables."""
+    ssh_key_path = tmp_path / "test_key"
+    ssh_key_path.write_text("-----BEGIN OPENSSH PRIVATE KEY-----\ntest\n-----END OPENSSH PRIVATE KEY-----")
+
+    return {
+        "HETZNER_API_TOKEN": "test-hetzner-token",
+        "R2_ACCESS_KEY_ID": "test-r2-key",
+        "R2_SECRET_ACCESS_KEY": "test-r2-secret",
+        "R2_ENDPOINT": "test.r2.cloudflarestorage.com",
+        "R2_ARTIFACTS_BUCKET": "test-artifacts",
+        "SSH_PUBLIC_KEY": "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAITest",
+        "SSH_PRIVATE_KEY": "-----BEGIN OPENSSH PRIVATE KEY-----\ntest\n-----END OPENSSH PRIVATE KEY-----",
+        "SSH_PRIVATE_KEY_PATH": str(ssh_key_path),
+        "CLOUDFLARE_API_TOKEN": "test-cf-token",
+        "ICEBERG_REST_URI": "https://api.cloudflare.com/test",
+        "R2_WAREHOUSE_NAME": "test-warehouse",
+    }
+
+
+@pytest.fixture
+def mock_secrets(mock_esc_env):
+    """Mock the secrets module to return test secrets."""
+    with patch("materia.secrets._load_environment", return_value=mock_esc_env):
+        yield
+
+
+@pytest.fixture
+def mock_hcloud_client():
+    """Mock Hetzner Cloud client."""
+    with patch("materia.providers.hetzner.Client") as mock_client:
+        client_instance = Mock()
+        mock_client.return_value = client_instance
+
+        client_instance.ssh_keys.get_all.return_value = []
+        client_instance.ssh_keys.create.return_value = Mock(id=1, name="materia-key")
+
+        mock_server = Mock()
+        mock_server.id = 12345
+        mock_server.name = "test-worker"
+        mock_server.status = "running"
+        mock_server.public_net.ipv4.ip = "192.0.2.1"
+        mock_server.server_type.name = "ccx12"
+        mock_server.wait_until_status_is = Mock()
+        mock_server.delete = Mock()
+
+        mock_response = Mock()
+        mock_response.server = mock_server
+
+        client_instance.servers.create.return_value = mock_response
+        client_instance.servers.get_all.return_value = []
+        client_instance.servers.get_by_id.return_value = mock_server
+
+        yield client_instance
+
+
+@pytest.fixture
+def mock_ssh_wait():
+    """Mock SSH wait function to return immediately."""
+    with patch("materia.providers.hetzner.wait_for_ssh", return_value=True):
+        yield
+
+
+@pytest.fixture
+def mock_ssh_connection():
+    """Mock paramiko SSH connection."""
+    with patch("materia.pipelines.paramiko.SSHClient") as mock_ssh_class, \
+         patch("materia.pipelines.paramiko.RSAKey.from_private_key_file") as mock_key:
+        ssh_instance = Mock()
+        mock_ssh_class.return_value = ssh_instance
+        mock_key.return_value = Mock()
+
+        ssh_instance.connect = Mock()
+        ssh_instance.set_missing_host_key_policy = Mock()
+
+        mock_channel = Mock()
+        mock_channel.recv_exit_status.return_value = 0
+
+        mock_stdout = Mock()
+        mock_stdout.read.return_value = b"Success\n"
+        mock_stdout.channel = mock_channel
+
+        mock_stderr = Mock()
+        mock_stderr.read.return_value = b""
+
+        ssh_instance.exec_command = Mock(
+            return_value=(Mock(), mock_stdout, mock_stderr)
+        )
+        ssh_instance.close = Mock()
+
+        yield ssh_instance