Gitea: declare the Dex login source in Helm values

Records the source that was configured live with gitea admin auth:
OIDC discovery from Dex, groups scope, and login restricted to members
of Gitea Users via the groups claim. Needs gitea_dex_client_secret in
Vault (the same secret as Dex's gitea client).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tasks/gitea.yaml

@@ -74,6 +74,19 @@
             bindPassword: "{{ openldap_readonly_password }}"
             usernameAttribute: uid
             publicSSHKeyAttribute: sshPublicKey
+        # Sign-in through Dex; only members of Gitea Users (sent in the groups
+        # claim) may log in. The name "Dex" fixes the callback URL
+        # /user/oauth2/Dex/callback registered in Dex.
+        oauth:
+          - name: Dex
+            provider: openidConnect
+            key: gitea
+            secret: "{{ gitea_dex_client_secret }}"
+            autoDiscoverUrl: https://dex.eom.dev/.well-known/openid-configuration
+            scopes: "openid profile email groups"
+            requiredClaimName: groups
+            requiredClaimValue: Gitea Users
+            groupClaimName: groups
         config:
           APP_NAME: "Gitea"
           service: