Add internal-only middleware to Gitea IngressRoute

Restrict Gitea web UI to LAN access only, matching other
platform services. SSH NodePort (30022) is unaffected.

infra/kubernetes/platform/traefik/ingressroute-gitea.yaml

@@ -11,6 +11,9 @@ spec:
   routes:
     - match: Host(`gitea.coreworlds.io`)
       kind: Rule
+      middlewares:
+        - name: internal-only
+          namespace: platform
       services:
         - name: gitea-helm-http
           namespace: platform