ci: six runners; SSO #8 Gitea sign-in hardening (staged)

- runner-5/6: 50+ jobs were queued with ~11 private repos onboarded. dind
  keeps the 12-core ceiling, so this adds concurrency, not CPU.
- Gitea: password + passkey sign-in forms off (break-glass = CLI), and
  ACCOUNT_LINKING auto -> login. auto linked any hub login whose email
  matched an existing account, and SITE ADMIN windyadmin carries Grant's
  email. Grant is linked by the hub's stable sub, which matches first.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docker-compose.yml

@@ -57,12 +57,26 @@ services:
       # G2.2 — OIDC only. No local password login, no self-registration.
       GITEA__service__DISABLE_REGISTRATION: "true"
       GITEA__service__ALLOW_ONLY_EXTERNAL_REGISTRATION: "true"
+      # SSO #8 (2026-09-23): the password and passkey forms are OFF. windyadmin
+      # is site admin with a local password; leaving the form up made that
+      # password a second, phishable way into the whole forge. Break-glass is
+      # the CLI on Veron (`docker exec -u git windy-git-gitea-1 gitea admin ...`).
+      GITEA__service__ENABLE_PASSWORD_SIGNIN_FORM: "false"
+      GITEA__service__ENABLE_PASSKEY_AUTHENTICATION: "false"
       # G3.1 — a Windy account IS the account. Signing in with Windy provisions
       # the Gitea user on first arrival; nobody is asked to invent a second
       # identity for the same person, and no local password ever exists.
       GITEA__oauth2_client__ENABLE_AUTO_REGISTRATION: "true"
       GITEA__oauth2_client__USERNAME: email
-      GITEA__oauth2_client__ACCOUNT_LINKING: auto
+      # 🔴 `login`, NOT `auto` (SSO #8). `auto` linked any hub login whose EMAIL
+      # matched an existing account — and windyadmin (SITE ADMIN) carries Grant's
+      # email, so the forge's admin rights rested on the hub never letting anyone
+      # else hold that address. `login` makes an email match prove possession of
+      # the existing account first. Grant is unaffected: his account is already
+      # linked by the hub's stable `sub`, which is matched before email.
+      # ⚠️ env-to-ini SETS but never UNSETS — this value must also be edited in
+      # /srv/windygit/git/gitea/conf/app.ini if it is ever removed from here.
+      GITEA__oauth2_client__ACCOUNT_LINKING: login
       # The email is asserted by account-server, which is the authority on it.
       # Asking the user to re-verify an address their identity provider already
       # verified is friction that buys nothing.