Add Gitea self-hosted git/CI/registry to replace GitHub

Deploy Gitea via Helm with dedicated CloudNativePG database,
in-cluster Actions runner (DinD), and built-in container registry.
ArgoCD repoURLs updated to use in-cluster Gitea SSH. Preview
ApplicationSet switched from GitHub PR generator to Gitea PR
generator. App images now pull from gitea.coreworlds.io registry.

Remaining setup after deploy: seal runner token, ArgoCD API token,
and registry pull secret once Gitea is running. Add ArgoCD deploy
key to Gitea repo settings.

CLAUDE.md

@@ -10,7 +10,7 @@ GitOps via ArgoCD, bare-metal provisioning via Ansible, Turborepo for app builds
 - **Infrastructure**: k3s, ArgoCD, Ansible
 - **Platform**: Traefik, cert-manager, CloudNativePG, Valkey, Longhorn, Sealed Secrets
 - **Observability**: kube-prometheus-stack, Loki, Promtail, Grafana
-- **CI/CD**: GitHub Actions → ghcr.io → ArgoCD
+- **CI/CD**: Gitea Actions → gitea.coreworlds.io registry → ArgoCD
 - **Task Runner**: Taskfile (go-task)
 
 ## Directory Structure
@@ -28,7 +28,9 @@ GitOps via ArgoCD, bare-metal provisioning via Ansible, Turborepo for app builds
 - Secrets are sealed with kubeseal before committing
 - Branch deploys create `preview-<PR#>` namespaces automatically
 - Use `task <command>` for all operations (see Taskfile.yaml)
-- Docker images tagged with git SHA, pushed to ghcr.io
+- Docker images tagged with git SHA, pushed to gitea.coreworlds.io registry
+- Git hosted on self-hosted Gitea, GitHub is a read-only push mirror
+- Gitea Actions runners: in-cluster (amd64), Mac (arm64), Windows (WSL2)
 
 ## Common Commands
 ```bash