Establish clean homelab infrastructure baseline

Reorganize the brownfield repository, remove retired and generated artifacts, harden ignore rules, and record the GitOps/IaC redesign.

apps/gitea/secret.example.yaml

@@ -0,0 +1,21 @@
+# Template. Copy to secret.yaml, fill in the real password, apply, then
+# `helm upgrade`. secret.yaml is gitignored — same convention as ../../platform/cert-manager,
+# ../netbox, ../smtp-relay and ../../infrastructure/cloudflared.
+#
+# Consumed by gitea.additionalConfigFromEnvs in gitea-values.yaml as
+# GITEA__DATABASE__PASSWD, which Gitea's env-to-ini step renders into
+# `[database] PASSWD`.
+#
+# This is the `gitea` role's password on the shared CloudNativePG cluster
+# (shared-postgresql.shared-db.svc.cluster.local). Rotating it means updating
+# both this Secret and the role in Postgres, then restarting Gitea — Gitea reads
+# app.ini once at startup and does not re-read it.
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: gitea-db
+  namespace: gitea
+type: Opaque
+stringData:
+  password: REPLACE_WITH_GITEA_DB_PASSWORD