ci: six runners; SSO #8 Gitea sign-in hardening (staged)

- runner-5/6: 50+ jobs were queued with ~11 private repos onboarded. dind
  keeps the 12-core ceiling, so this adds concurrency, not CPU.
- Gitea: password + passkey sign-in forms off (break-glass = CLI), and
  ACCOUNT_LINKING auto -> login. auto linked any hub login whose email
  matched an existing account, and SITE ADMIN windyadmin carries Grant's
  email. Grant is linked by the hub's stable sub, which matches first.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

deploy/runner/config.yaml

@@ -11,7 +11,7 @@ log:
 
 runner:
   file: /data/.runner
-  capacity: 1          # per runner; parallelism = number of runner services (4). See docker-compose.yml
+  capacity: 1          # per runner; parallelism = number of runner services (6). See docker-compose.yml
   timeout: 30m
   shutdown_timeout: 3m
   insecure: false