feat(FN-269): CI QA gate workflow + memory policy

Commits merged:
- feat(FN-269): complete Step 1 — CI QA gate workflow + memory policy

Files changed:
.fusion/memory/MEMORY.md      | 10 ++++++++
 .github/workflows/qa-gate.yml | 58 +++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 68 insertions(+)

Fusion-Task-Id: FN-269

.fusion/memory/MEMORY.md

@@ -41,6 +41,16 @@ Highlights to remember:
 - **External integration timeouts** (PL24, EMEX, PartsCatalogs, iyzico) are not always our bug. Vendor incidents go in `vendor-incidents` memory namespace and may suppress related auto-fix tasks during the outage window.
 - **Migrations on dev** still need human ack — even though dev is staging, schema changes can desync persisted state across the team's local environments.
 
+## Pre-Merge QA Gate (active 2026-05-12)
+
+Policy: No P0 or P1 task may be marked "done" without:
+1. A passing regression test for the affected surface (`pnpm test` for affected app)
+2. A QA review document with reproduction steps, acceptance checks, and signoff timestamp
+
+Enforcement: GitHub Actions `qa-gate.yml` blocks merge if tests fail. Task-level check is manual until Fusion supports automated document verification.
+
+Non-P0/P1 tasks: Recommended but not required.
+
 ## Context
 
 - **Deploy:** Auto on push to `dev` (→ dev.sase.tr) and `main` (→ sase.tr). Both webhooks live on `git.semih.ai/root/sase.tr` and call Coolify's `/api/v1/deploy?uuid=...&force=true`. No PM2 / GitHub Actions in the loop anymore — the CLAUDE.md mention of `GitHub Actions → SSH → PM2` is historical; current deploy is Coolify-driven.

.github/workflows/qa-gate.yml

@@ -0,0 +1,58 @@
+name: QA Gate (P0/P1)
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened]
+    paths:
+      - "apps/api/**"
+      - "apps/web/**"
+
+concurrency:
+  group: qa-gate-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
+
+jobs:
+  test-affected:
+    name: Test affected app
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - uses: pnpm/action-setup@v4
+        with:
+          version: 10
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: "pnpm"
+
+      - run: pnpm install --frozen-lockfile
+
+      - name: Determine affected app
+        id: affected
+        run: |
+          API_CHANGED=false
+          WEB_CHANGED=false
+
+          if git diff --name-only "origin/${{ github.base_ref }}...HEAD" | grep -q '^apps/api/'; then
+            API_CHANGED=true
+          fi
+          if git diff --name-only "origin/${{ github.base_ref }}...HEAD" | grep -q '^apps/web/'; then
+            WEB_CHANGED=true
+          fi
+
+          echo "api_changed=$API_CHANGED" >> $GITHUB_OUTPUT
+          echo "web_changed=$WEB_CHANGED" >> $GITHUB_OUTPUT
+
+      - name: Run API tests
+        if: steps.affected.outputs.api_changed == 'true'
+        run: pnpm --filter api test
+
+      - name: Run Web tests
+        if: steps.affected.outputs.web_changed == 'true'
+        run: pnpm --filter web test