ci: run the check job in a container so "postgres" resolves

On GitHub's hosted runners a job that isn't in a container can't reach
a service by its name, so every database test failed with getaddrinfo
EAI_AGAIN postgres. The check job now runs in node:24 (Gitea/Forgejo
act_runner already runs jobs in containers) and installs ffmpeg so the
sound and greeting tests run instead of skipping. The voicemail test's
afterAll no longer throws when beforeAll failed.

Checked locally by running the job's steps in node:24 next to a
postgres:18-alpine reachable as "postgres": 481 passed, 5 skipped
(ffmpeg).

Task: M5-T3

apps/api/test/voicemail.test.ts

@@ -60,7 +60,7 @@ describe.skipIf(!hasTestDb)('voicemail watcher', () => {
   });
   afterAll(async () => {
     await t?.close();
-    rmSync(spool, { recursive: true, force: true });
+    if (spool) rmSync(spool, { recursive: true, force: true }); // unset if beforeAll failed
   });
 
   it('a new message: indexed, owner told, emailed with the audio (on MessageWaiting)', async () => {