feat(gitea): require sign-in to read anything; Flux and CI authenticate first

Gitea stays public on the Cloudflare Tunnel, but anonymous crawlers have kept
the pod at 2-6 cores since PR #156. Operator decision 2026-11-14: reading
anything requires a (Keycloak) login.

- catalog/gitea.yaml (+ re-rendered apps/wave-0/gitea.yaml):
  GITEA__service__REQUIRE_SIGNIN_VIEW=true (strict: web, API, git pull,
  registry /v2/token), and a postStart-written robots.txt (Disallow: /).
- clusters/prod: flux-system GitRepository gets secretRef flux-gitea-read,
  an OUT-OF-BAND read:repository token the operator must create BEFORE merge.
- gate.yml / cve-triage.yaml: the toolbox job image was pulled anonymously
  from the Gitea registry; it now uses container.credentials with the
  existing RENOVATE_TOKEN (read:package, proven by renovate.yaml preflight).

Anonymous-reader inventory and operator steps:
decisions/2026-11-14-gitea-require-signin.md

Co-Authored-By: Claude Opus 5.5 <[email protected]>

clusters/prod/kustomization.yaml

@@ -242,6 +242,10 @@ patches:
   #   git ls-remote http://192.168.2.132:3000/Home-Network/home-network-k3s-impl.git  -> refs/heads/main
   # If the GitRepository ever reports an auth failure that looks like a network problem, RE-CHECK
   # THAT FIRST: a private repo here fails exactly that way.
+  # SUPERSEDED FOR PROD'S OWN GITEA (2026-11-14): the patch below now carries a secretRef, because
+  # prod's Gitea requires sign-in. If prod is ever re-bootstrapped from the workstation container,
+  # the `flux-gitea-read` token must be valid THERE too (Gitea rejects a bad credential even on a
+  # public repo), or drop the secretRef for the bring-up window.
   #
   # *** CUTOVER — the exit condition, mirroring dev's Phase-6 cutover (docs/05) ***
   #   WHEN: Gitea runs on prod (reconciled in-cluster) and answers gitea.home.keithjackson.dev
@@ -317,12 +321,28 @@ patches:
         # domain change cannot sever prod from its own source again.
         #
         # Plain http is deliberate and safe here: it is cluster-internal traffic to a ClusterIP,
-        # TLS terminates at the Gateway for external clients only, the GitRepository has no
-        # secretRef (the repo is cloned anonymously), and every secret in the tree is SOPS-encrypted
-        # at rest regardless of transport.
+        # TLS terminates at the Gateway for external clients only, and every secret in the tree is
+        # SOPS-encrypted at rest regardless of transport. The read token below crosses that same
+        # pod-to-ClusterIP hop in a basic-auth header; it is read-only by scope.
         url: http://gitea.gitea.svc.cluster.local:3000/Home-Network/home-network-k3s-impl.git
         ref:
           branch: main
+        # AUTHENTICATED SINCE 2026-11-14 — ANONYMOUS CLONE NO LONGER EXISTS. Gitea now runs with
+        # [service] REQUIRE_SIGNIN_VIEW=true (catalog/gitea.yaml), whose strict mode refuses the
+        # anonymous git pull path outright, public repo or not. Without this secretRef prod cannot
+        # fetch ANY new revision — including the one that would undo this.
+        #
+        # The Secret is OUT-OF-BAND, like `sops-age` beside it, and it has to be: it is the
+        # credential that lets Flux read git at all, so it cannot be delivered BY git (on a fresh
+        # cluster nothing could decrypt or apply it before the first fetch), and the root
+        # Kustomization that applies this file has no SOPS decryption anyway.
+        #   keys:  username  (any value; Gitea resolves the account from the token)
+        #          password  (a Gitea access token with scope read:repository ONLY)
+        # It MUST exist before this line reaches the cluster: a missing Secret stalls the source
+        # with "secret not found", and the fix is then exactly to create it. Operator steps:
+        # decisions/2026-11-14-gitea-require-signin.md.
+        secretRef:
+          name: flux-gitea-read
   - target:
       kind: ConfigMap
       name: cluster-vars