fix: gitea boot persistence via quadlet (incident 2026-08-16)

unattended-upgrades rebooted dankclaw at 15:01; the legacy
podman-compose gitea stack had no systemd units, so rootless podman
did not auto-start the containers. Gitea was down ~1 hour.

- add quadlet units (dankclaw/gitea/quadlet/): gitea-postgres,
  gitea-server, gitea-caddy + gitea.network (DNS enabled; the default
  rootless podman network has dns_enabled=false)
- add gitea stack Caddyfile (upstream gitea-server:3000) and
  .env.example; live password stays in /opt/gitea/.env (0600)
- fix latent name bugs in main stack config: DATABASE_HOST
  gitea-postgres, Caddyfile upstream gitea-server
- docs: rewrite Gitea page for the quadlet stack (management, boot
  persistence, secrets, gotchas, incident log); fix port 3000 in
  stack table; Postgres connection notes
- legacy compose retired on target to /opt/gitea/.deprecated/

docs/Dankclaw/Dankclaw Stack.md

@@ -23,7 +23,7 @@ graph LR
 | ComfyUI | comfyui.dankclaw.local | 8188 | [[ComfyUI]] |
 | OpenWebUI | chat.dankclaw.local | 3000 | [[OpenWebUI]] |
 | Hermes | hermes.dankclaw.local | 8090 | [[Hermes]] |
-| Gitea | gitea.dankclaw.local | 3001 | [[Gitea]] |
+| Gitea | gitea.dankclaw.local | 3000 | [[Gitea]] |
 | Grafana | grafana.dankclaw.local | 3002 | [[Grafana]] |
 | Prometheus | prometheus.dankclaw.local | 9090 | [[Prometheus]] |
 | Homepage | dankclaw.local | 80/443 | — |