G2: Gitea auto-install, own DB role, SSH deferred, Actions on

Gitea was configured to connect as a 'gitea' DB user that never existed, so it
sat unconfigured behind a working tunnel. It now gets its OWN role and database
via a first-init script — I-1 says we never write Gitea's tables, and that is
better as a permission than as a promise.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

deploy/postgres/01-gitea-role.sh

@@ -0,0 +1,14 @@
+#!/bin/bash
+# Gitea gets its OWN role and database, not ours.
+#
+# I-1: Gitea is a component whose private state we never write to directly. That
+# boundary is worth enforcing at the database, not just in prose — our plane
+# holds schema `windgit` in `windygit`, and Gitea holds a database it alone can
+# reach. A shared login would make "we never write Gitea's tables" a promise
+# instead of a permission.
+set -e
+psql -v ON_ERROR_STOP=1 --username "$POSTGRES_USER" --dbname "$POSTGRES_DB" <<-SQL
+    CREATE ROLE gitea LOGIN PASSWORD '${GITEA_DB_PASSWORD:?GITEA_DB_PASSWORD must be set}';
+    CREATE DATABASE gitea OWNER gitea;
+    REVOKE ALL ON DATABASE gitea FROM PUBLIC;
+SQL