Gitea: sign in only through Dex, send sign-up to /members

Disable the password sign-in form so /user/login redirects to Dex,
keep registration enabled for Dex auto-registration, and redirect
/user/sign_up to www.eom.dev/members at the ingress.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tasks/gitea.yaml

@@ -64,8 +64,13 @@
         config:
           APP_NAME: "Gitea"
           service:
+            # Keep false: true would also block Dex auto-registration of members.
+            # The sign-up button is redirected to www.eom.dev/members at ingress.
             DISABLE_REGISTRATION: false
             SHOW_REGISTRATION_BUTTON: true
+            # Sign-in goes through Dex only (admin fallback: gitea admin CLI).
+            ENABLE_PASSWORD_SIGNIN_FORM: false
+            ENABLE_PASSKEY_AUTHENTICATION: false
             DEFAULT_ALLOW_CREATE_ORGANIZATION: false
             ALLOW_ONLY_EXTERNAL_REGISTRATION: true
             ENABLE_NOTIFY_MAIL: true
@@ -129,3 +134,31 @@
             size: 2Ti
       postgresql-ha:
         enabled: false
+
+- name: Send Gitea's sign-up button to the eom.dev membership site
+  kubernetes.core.k8s:
+    state: present
+    definition:
+      apiVersion: networking.k8s.io/v1
+      kind: Ingress
+      metadata:
+        name: gitea-signup-redirect
+        namespace: gitea
+        annotations:
+          nginx.ingress.kubernetes.io/temporal-redirect: https://www.eom.dev/members
+      spec:
+        ingressClassName: nginx
+        tls:
+          - hosts: [gitea.eom.dev]
+            secretName: gitea-tls
+        rules:
+          - host: gitea.eom.dev
+            http:
+              paths:
+                - path: /user/sign_up
+                  pathType: Exact
+                  backend:
+                    service:
+                      name: gitea-http
+                      port:
+                        number: 3000