Add Gitea self-hosted git/CI/registry to replace GitHub

Deploy Gitea via Helm with dedicated CloudNativePG database,
in-cluster Actions runner (DinD), and built-in container registry.
ArgoCD repoURLs updated to use in-cluster Gitea SSH. Preview
ApplicationSet switched from GitHub PR generator to Gitea PR
generator. App images now pull from gitea.coreworlds.io registry.

Remaining setup after deploy: seal runner token, ArgoCD API token,
and registry pull secret once Gitea is running. Add ArgoCD deploy
key to Gitea repo settings.

infra/kubernetes/argocd/argocd-gitea-token-sealed.yaml

@@ -0,0 +1,15 @@
+# PLACEHOLDER: Re-seal with Gitea API token for PR generator
+# ./scripts/seal-secret.sh argocd-gitea-token argocd token=<gitea-api-token>
+---
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  name: argocd-gitea-token
+  namespace: argocd
+spec:
+  encryptedData:
+    token: PLACEHOLDER_SEAL_ME
+  template:
+    metadata:
+      name: argocd-gitea-token
+      namespace: argocd