Log real client IPs and enable Gitea Actions with a runner

- Trust X-Forwarded-For from the pod network (10.244.0.0/16) via
  security.REVERSE_PROXY_TRUSTED_PROXIES / REVERSE_PROXY_LIMIT so Gitea
  logs the external client address instead of the ingress-nginx pod IP.
- Set actions.ENABLED explicitly and deploy an instance-wide runner via
  the gitea/actions chart (release "gitea-actions", pinned to 0.1.2).
  The registration token is generated in-cluster and stored in a Secret
  on first run, so no token lives in git or the vault.
- Fix the old actions.yaml, which reused the "gitea" release name and
  would have clobbered the main Gitea release.
- Add a demo workflow (.gitea/workflows/demo.yaml).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

.gitea/workflows/demo.yaml

@@ -0,0 +1,42 @@
+# Demo workflow showing Gitea Actions running on the in-cluster runner.
+name: Demo
+on:
+  push:
+  workflow_dispatch:
+
+jobs:
+  hello:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Say hello
+        run: |
+          echo "Hello from Gitea Actions on ${{ gitea.server_url }}"
+          echo "Repository: ${{ gitea.repository }}"
+          echo "Ref:        ${{ gitea.ref }}"
+          echo "Commit:     ${{ gitea.sha }}"
+          echo "Triggered by: ${{ gitea.actor }} (${{ gitea.event_name }})"
+
+      - name: Check out the role
+        uses: actions/checkout@v4
+
+      - name: Show the role layout
+        run: find . -path ./.git -prune -o -type f -print | sort
+
+      - name: Validate YAML
+        run: |
+          python3 -c 'import yaml' 2>/dev/null || (apt-get update -qq && apt-get install -y -qq python3-yaml >/dev/null)
+          python3 - <<'PY'
+          import pathlib, sys
+          import yaml
+          bad = 0
+          for p in sorted(pathlib.Path('.').rglob('*.y*ml')):
+              if '.git' in p.parts:
+                  continue
+              try:
+                  yaml.safe_load(p.read_text())
+                  print(f"ok   {p}")
+              except yaml.YAMLError as e:
+                  bad += 1
+                  print(f"FAIL {p}: {e}")
+          sys.exit(1 if bad else 0)
+          PY