Log real client IPs and enable Gitea Actions with a runner

- Trust X-Forwarded-For from the pod network (10.244.0.0/16) via
  security.REVERSE_PROXY_TRUSTED_PROXIES / REVERSE_PROXY_LIMIT so Gitea
  logs the external client address instead of the ingress-nginx pod IP.
- Set actions.ENABLED explicitly and deploy an instance-wide runner via
  the gitea/actions chart (release "gitea-actions", pinned to 0.1.2).
  The registration token is generated in-cluster and stored in a Secret
  on first run, so no token lives in git or the vault.
- Fix the old actions.yaml, which reused the "gitea" release name and
  would have clobbered the main Gitea release.
- Add a demo workflow (.gitea/workflows/demo.yaml).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

defaults/main.yml

@@ -1,3 +1,13 @@
 #SPDX-License-Identifier: MIT-0
 ---
 # defaults file for ansible-role-gitea
+
+# CIDRs allowed to set X-Forwarded-For / X-Real-IP for Gitea.
+# 10.244.0.0/16 is the cluster pod network, where ingress-nginx runs.
+gitea_trusted_proxies: "127.0.0.0/8,::1/128,10.244.0.0/16"
+
+# Gitea Actions runner (gitea/actions chart)
+gitea_actions_enabled: true
+gitea_actions_chart_version: 0.1.2
+gitea_actions_runner_replicas: 1
+gitea_actions_runner_token_secret: gitea-actions-runner-token