fix(gitea): mount PVC at /data + headless-install bootstrap (Phase 6)

Two defects blocked in-cluster Gitea from becoming the Flux source:

1. Storage mountPath: the renderer hard-coded /data/<name>, so Gitea's PVC
   mounted at /data/data while Gitea writes all state to /data — real repos/DB
   landed on the ephemeral rootfs. Add an OPTIONAL `mountPath` to the storage
   schema + render.py (default stays /data/<name>, back-compat). catalog/gitea.yaml
   sets data.mountPath: /data. Only gitea.yaml's rendered mount changes; every
   other app renders byte-identical.

2. Headless install: the instance was un-installed (INSTALL_LOCK=false, ephemeral
   SECRET_KEY, no admin, API 404). A Gitea-only supplementary manifest
   (apps/gitea-bootstrap-patch.yaml) patches the rendered Deployment with
   GITEA__security__INSTALL_LOCK=true, a FIXED SECRET_KEY from a persistent SOPS
   secret (apps/gitea-bootstrap-secret.sops.yaml), ROOT_URL/DOMAIN, and a postStart
   hook that idempotently creates a break-glass local admin. State persists on the
   now-correct /data Longhorn PVC.

The env/lifecycle wiring is a supplementary kustomize patch because the
ServiceDefinition schema/renderer does not yet express env/envFrom/lifecycle —
noted as a renderer follow-up (TODO in the patch).

Co-Authored-By: Claude Opus 4.8 <[email protected]>

catalog/render.py

@@ -220,7 +220,11 @@ def r_deployment(s: dict) -> dict:
 
     volume_mounts, volumes = [], []
     for vol in s["storage"]:
-        volume_mounts.append({"name": vol["name"], "mountPath": f"/data/{vol['name']}"})
+        # Default mount is /data/<name>; an explicit `mountPath` (schema-optional) overrides
+        # it verbatim for apps that need a fixed on-disk layout (e.g. Gitea keeps all state
+        # directly under /data). Omitting it preserves the /data/<name> default (back-compat).
+        mount_path = vol.get("mountPath", f"/data/{vol['name']}")
+        volume_mounts.append({"name": vol["name"], "mountPath": mount_path})
         volumes.append(
             {
                 "name": vol["name"],