Add Gitea self-hosted git/CI/registry to replace GitHub

Deploy Gitea via Helm with dedicated CloudNativePG database,
in-cluster Actions runner (DinD), and built-in container registry.
ArgoCD repoURLs updated to use in-cluster Gitea SSH. Preview
ApplicationSet switched from GitHub PR generator to Gitea PR
generator. App images now pull from gitea.coreworlds.io registry.

Remaining setup after deploy: seal runner token, ArgoCD API token,
and registry pull secret once Gitea is running. Add ArgoCD deploy
key to Gitea repo settings.

Taskfile.yaml

@@ -95,6 +95,40 @@ tasks:
     cmds:
       - kubectl port-forward -n platform svc/homelab-pg-rw 5432:5432
 
+  # Gitea
+  gitea:status:
+    desc: Check Gitea runners and mirror sync status
+    cmds:
+      - |
+        echo "=== Gitea Runners ==="
+        curl -s -H "Authorization: token $(kubectl get secret argocd-gitea-token -n argocd -o jsonpath='{.data.token}' | base64 -d)" \
+          https://gitea.coreworlds.io/api/v1/admin/runners | jq '.[] | {name, online, labels}'
+        echo ""
+        echo "=== Mirror Sync ==="
+        curl -s -H "Authorization: token $(kubectl get secret argocd-gitea-token -n argocd -o jsonpath='{.data.token}' | base64 -d)" \
+          https://gitea.coreworlds.io/api/v1/repos/julia/homelab | jq '{mirror: .mirror, mirror_updated: .mirror_updated}'
+
+  gitea:runner:register:
+    desc: Register an external Gitea Actions runner
+    cmds:
+      - |
+        echo "Run on the target machine:"
+        echo "  act_runner register --instance https://gitea.coreworlds.io --token <TOKEN> --labels '<labels>'"
+        echo ""
+        echo "Labels:"
+        echo "  Mac:     macos-arm64:host,arm64:host,self-hosted:host"
+        echo "  Windows: windows:host,wsl2:host,self-hosted:host"
+
+  gitea:runner:mac:start:
+    desc: Start Gitea runner on Mac (run on Mac)
+    cmds:
+      - act_runner daemon
+
+  gitea:runner:mac:stop:
+    desc: Stop Gitea runner on Mac (run on Mac)
+    cmds:
+      - pkill act_runner || true
+
   # Linting
   lint:ansible:
     desc: Lint Ansible playbooks