fix: gitea boot persistence via quadlet (incident 2026-08-16)

unattended-upgrades rebooted dankclaw at 15:01; the legacy
podman-compose gitea stack had no systemd units, so rootless podman
did not auto-start the containers. Gitea was down ~1 hour.

- add quadlet units (dankclaw/gitea/quadlet/): gitea-postgres,
  gitea-server, gitea-caddy + gitea.network (DNS enabled; the default
  rootless podman network has dns_enabled=false)
- add gitea stack Caddyfile (upstream gitea-server:3000) and
  .env.example; live password stays in /opt/gitea/.env (0600)
- fix latent name bugs in main stack config: DATABASE_HOST
  gitea-postgres, Caddyfile upstream gitea-server
- docs: rewrite Gitea page for the quadlet stack (management, boot
  persistence, secrets, gotchas, incident log); fix port 3000 in
  stack table; Postgres connection notes
- legacy compose retired on target to /opt/gitea/.deprecated/

dankclaw/Caddyfile

@@ -48,7 +48,7 @@ hermes.dankclaw.local {
 
 # --- Gitea (migrated) ---
 gitea.dankclaw.local {
-	reverse_proxy gitea:3000
+	reverse_proxy gitea-server:3000
 }
 
 # --- Grafana ---