Log real client IPs and enable Gitea Actions with a runner

- Trust X-Forwarded-For from the pod network (10.244.0.0/16) via
  security.REVERSE_PROXY_TRUSTED_PROXIES / REVERSE_PROXY_LIMIT so Gitea
  logs the external client address instead of the ingress-nginx pod IP.
- Set actions.ENABLED explicitly and deploy an instance-wide runner via
  the gitea/actions chart (release "gitea-actions", pinned to 0.1.2).
  The registration token is generated in-cluster and stored in a Secret
  on first run, so no token lives in git or the vault.
- Fix the old actions.yaml, which reused the "gitea" release name and
  would have clobbered the main Gitea release.
- Add a demo workflow (.gitea/workflows/demo.yaml).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tasks/main.yml

@@ -2,6 +2,8 @@
 ---
 # tasks file for ansible-role-gitea
 - name: gitea
-  include_tasks: "{{ item }}"
-  loop:
-    - gitea.yaml
+  include_tasks: gitea.yaml
+
+- name: gitea actions runner
+  include_tasks: actions.yaml
+  when: gitea_actions_enabled | bool