Add Gitea self-hosted git/CI/registry to replace GitHub

Deploy Gitea via Helm with dedicated CloudNativePG database,
in-cluster Actions runner (DinD), and built-in container registry.
ArgoCD repoURLs updated to use in-cluster Gitea SSH. Preview
ApplicationSet switched from GitHub PR generator to Gitea PR
generator. App images now pull from gitea.coreworlds.io registry.

Remaining setup after deploy: seal runner token, ArgoCD API token,
and registry pull secret once Gitea is running. Add ArgoCD deploy
key to Gitea repo settings.

.gitea/workflows/ci.yaml

@@ -0,0 +1,87 @@
+name: CI
+
+on:
+  pull_request:
+    branches: [main]
+  push:
+    branches: [main]
+
+concurrency:
+  group: ${{ gitea.workflow }}-${{ gitea.ref }}
+  cancel-in-progress: true
+
+jobs:
+  changes:
+    runs-on: ubuntu-latest
+    outputs:
+      apps: ${{ steps.filter.outputs.apps }}
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Detect changed apps
+        id: filter
+        run: |
+          if [ "${{ gitea.event_name }}" = "pull_request" ]; then
+            CHANGED=$(git diff --name-only origin/main...HEAD)
+          else
+            CHANGED=$(git diff --name-only HEAD~1)
+          fi
+          APPS="[]"
+          for app in web api harness; do
+            if echo "$CHANGED" | grep -qE "^(apps/${app}/|packages/)"; then
+              APPS=$(echo "$APPS" | jq -c ". + [\"${app}\"]")
+            fi
+          done
+          echo "apps=$APPS" >> "$GITHUB_OUTPUT"
+
+  lint-and-test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: pnpm/action-setup@v4
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 20
+          cache: pnpm
+
+      - run: pnpm install --frozen-lockfile
+
+      - run: pnpm turbo lint test
+
+  build:
+    needs: [changes, lint-and-test]
+    runs-on: ubuntu-latest
+    if: needs.changes.outputs.apps != '[]'
+    strategy:
+      matrix:
+        app: ${{ fromJson(needs.changes.outputs.apps) }}
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: pnpm/action-setup@v4
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 20
+          cache: pnpm
+
+      - run: pnpm install --frozen-lockfile
+
+      - run: pnpm turbo build --filter=@homelab/${{ matrix.app }}
+
+      - name: Build Docker image
+        run: |
+          docker build \
+            -t gitea.coreworlds.io/julia/homelab-${{ matrix.app }}:${{ gitea.sha }} \
+            -t gitea.coreworlds.io/julia/homelab-${{ matrix.app }}:pr-${{ gitea.event.number }} \
+            apps/${{ matrix.app }}
+
+      - name: Push to registry
+        if: gitea.event_name == 'push' || gitea.event_name == 'pull_request'
+        run: |
+          echo "${{ secrets.GITEA_TOKEN }}" | docker login gitea.coreworlds.io -u ${{ gitea.actor }} --password-stdin
+          docker push gitea.coreworlds.io/julia/homelab-${{ matrix.app }}:${{ gitea.sha }}