feat: add Gitea Actions runner (#6)

## Summary
- Adds a private runner server on the Hetzner private network (no public IP)
- NAT through the gitea server for outbound internet access via `hcloud_network_route` and iptables forwarding rules
- Runner connects to gitea over HTTPS on the private network with TLS verification disabled
- Includes Taskfile commands for runner deployment and SSH access

## Test plan
- [x] Runner registers with gitea instance
- [x] Private network connectivity verified
- [ ] Run a test workflow to confirm end-to-end CI

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Reviewed-on: #6
Co-authored-by: M.V. Hutz <git@maximhutz.me>
Co-committed-by: M.V. Hutz <git@maximhutz.me>

terraform/network.tf

@@ -0,0 +1,24 @@
+resource "hcloud_network" "private_network" {
+  name     = "repository-network"
+  ip_range = local.network_cidr
+}
+
+resource "hcloud_network_subnet" "private_subnet" {
+  network_id   = hcloud_network.private_network.id
+  type         = "cloud"
+  network_zone = local.network_zone
+  ip_range     = local.subnet_cidr
+}
+
+resource "hcloud_server_network" "server_network" {
+  server_id  = hcloud_server.server_instance.id
+  network_id = hcloud_network.private_network.id
+  ip         = local.server_ip
+}
+
+resource "hcloud_network_route" "nat_route" {
+  network_id  = hcloud_network.private_network.id
+  destination = "0.0.0.0/0"
+  gateway     = local.server_ip
+}
+