fix: gitea boot persistence via quadlet (incident 2026-08-16)

unattended-upgrades rebooted dankclaw at 15:01; the legacy
podman-compose gitea stack had no systemd units, so rootless podman
did not auto-start the containers. Gitea was down ~1 hour.

- add quadlet units (dankclaw/gitea/quadlet/): gitea-postgres,
  gitea-server, gitea-caddy + gitea.network (DNS enabled; the default
  rootless podman network has dns_enabled=false)
- add gitea stack Caddyfile (upstream gitea-server:3000) and
  .env.example; live password stays in /opt/gitea/.env (0600)
- fix latent name bugs in main stack config: DATABASE_HOST
  gitea-postgres, Caddyfile upstream gitea-server
- docs: rewrite Gitea page for the quadlet stack (management, boot
  persistence, secrets, gotchas, incident log); fix port 3000 in
  stack table; Postgres connection notes
- legacy compose retired on target to /opt/gitea/.deprecated/

docs/Dankclaw/Postgres.md

@@ -29,17 +29,19 @@ services:
 
 ## Gitea Connection
 
-Gitea reaches the database over the podman network:
+Gitea reaches the database over the `systemd-gitea` network (quadlet-managed live, compose-managed after the full-stack deploy):
 
 ```yaml
 environment:
   DATABASE_TYPE: postgres
-  DATABASE_HOST: postgres
+  DATABASE_HOST: gitea-postgres
   DATABASE_NAME: gitea
   DATABASE_USER: gitea
   DATABASE_PASSWD: "${GITEA_DB_PASSWORD}"
 ```
 
+The live `app.ini` on the host overrides env vars. When you rename the database container, update its `[database] HOST` line. See [[Gitea]] Gotchas.
+
 ## Migration
 
 The live Gitea stack on Dankclaw already runs this image with the data at `/opt/gitea/data/gitea-postgres`. The migration keeps the bind mount in place; see [[Gitea]].