feat(forgejo): Git self-host en miroir de GitHub (git.funklab.online, SSO Authentik) (#96)

- k8s/apps/forgejo : deployment (image forgejo:11, config par env), service, PVC nfs,
  IngressRoute interne (git.lab.local) + publique (git.funklab.online + middlewares
  security-headers/ratelimit), Application ArgoCD (ns ai, recurse)
- base PostgreSQL `forgejo` sur storage-01 (rôle postgresql)
- vault : vault_pg_forgejo_password + vault_forgejo_oauth_client_secret
- doc admin/k8s/forgejo.md (archi, OIDC, création du miroir, pièges) + index + CLAUDE.md

GitHub reste la source de vérité (pull-mirror lecture seule) — ArgoCD inchangé.

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

k8s/apps/forgejo/ingress-public.yaml

@@ -0,0 +1,24 @@
+# Accès public HTTPS — git.funklab.online (cert Let's Encrypt auto).
+# Hérite du durcissement edge : middlewares security-headers + ratelimit (ns infra).
+# Route interne git.lab.local conservée (ingress.yaml).
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: forgejo-public
+  namespace: ai
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`git.funklab.online`)
+      kind: Rule
+      middlewares:
+        - name: security-headers
+          namespace: infra
+        - name: ratelimit
+          namespace: infra
+      services:
+        - name: forgejo
+          port: 3000
+  tls:
+    certResolver: letsencrypt