feat(forgejo): Git self-host en miroir de GitHub (git.funklab.online, SSO Authentik)

- k8s/apps/forgejo : deployment (image forgejo:11, config par env), service, PVC nfs,
  IngressRoute interne (git.lab.local) + publique (git.funklab.online + middlewares
  security-headers/ratelimit), Application ArgoCD (ns ai, recurse)
- base PostgreSQL `forgejo` sur storage-01 (rôle postgresql)
- vault : vault_pg_forgejo_password + vault_forgejo_oauth_client_secret
- doc admin/k8s/forgejo.md (archi, OIDC, création du miroir, pièges) + index + CLAUDE.md

GitHub reste la source de vérité (pull-mirror lecture seule) — ArgoCD inchangé.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

ansible/roles/postgresql/defaults/main.yml

@@ -13,7 +13,7 @@ postgresql_shared_buffers: "256MB"
 # Mots de passe dans le vault : vault_pg_hermes_password, vault_pg_litellm_password,
 #                               vault_pg_openwebui_password, vault_pg_n8n_password,
 #                               vault_pg_ghostfolio_password, vault_pg_authentik_password,
-#                               vault_pg_guacamole_password
+#                               vault_pg_guacamole_password, vault_pg_forgejo_password
 postgresql_databases:
   - name: hermes
   - name: litellm
@@ -22,6 +22,7 @@ postgresql_databases:
   - name: ghostfolio
   - name: authentik
   - name: guacamole
+  - name: forgejo
 
 postgresql_users:
   - name: hermes
@@ -45,3 +46,6 @@ postgresql_users:
   - name: guacamole
     password: "{{ vault_pg_guacamole_password }}"
     db: guacamole
+  - name: forgejo
+    password: "{{ vault_pg_forgejo_password }}"
+    db: forgejo