Codify host firewall + Gitea bootstrap as IaC (hands-off rebuild)

Per operator: the firewalld rule (VM->host:3000 for the Flux<-Gitea source) must be
IaC, not a manual command (R-ENV-01, R-PLAT-04).
- infra/ansible/playbooks/host-prereqs.yml: idempotent firewalld open on the libvirt
  zone (localhost play, become; no extra collection).
- bootstrap/gitea/bootstrap-gitea.sh: now fully automates admin + public repo + push
  (was manual instructions) — idempotent; creds stay 0600 on host, never committed.
Applying host-prereqs still needs host sudo (I lack non-interactive sudo); with
passwordless become a destroy/rebuild is fully unattended.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

DECISIONS-LOG.md

@@ -27,9 +27,12 @@ need the operator are called out.
   `platform/kyverno` (verified). Gate green.
 - **Flux INSTALLED** on the cluster (4 controllers Running). Host **Gitea working** (named-volume fix),
   repo pushed. GitRepository created → **BLOCKED**: cluster pods can't reach `10.73.0.1:3000`
-  (firewalld `libvirt` zone drops VM→host:3000). **Needs operator (one command, I lack sudo):**
-  `sudo firewall-cmd --zone=libvirt --add-port=3000/tcp --permanent && sudo firewall-cmd --reload`
-  Then Flux reconciles from Gitea (Phase-1 T-1.4 exit).
+  (firewalld `libvirt` zone drops VM→host:3000).
+  - **Now codified as IaC (per operator: no manual commands):** `infra/ansible/playbooks/host-prereqs.yml`
+    opens the port idempotently; `bootstrap/gitea/bootstrap-gitea.sh` now **fully automates** admin +
+    public repo + push (was manual). A rebuild is hands-off. To APPLY the firewall (I lack
+    non-interactive sudo): `ansible-playbook infra/ansible/playbooks/host-prereqs.yml --ask-become-pass`
+    (or passwordless host sudo for unattended rebuilds). Then Flux reconciles → Phase-1 T-1.4 exit.
 - **NOT deployed:** `platform`/`apps` Kustomizations were deliberately NOT created — the running
   cluster (Cilium etc.) is untouched. Only Flux controllers + the GitRepository source exist.