feat: add Gitea Actions runner (#6)

## Summary
- Adds a private runner server on the Hetzner private network (no public IP)
- NAT through the gitea server for outbound internet access via `hcloud_network_route` and iptables forwarding rules
- Runner connects to gitea over HTTPS on the private network with TLS verification disabled
- Includes Taskfile commands for runner deployment and SSH access

## Test plan
- [x] Runner registers with gitea instance
- [x] Private network connectivity verified
- [ ] Run a test workflow to confirm end-to-end CI

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Reviewed-on: #6
Co-authored-by: M.V. Hutz <git@maximhutz.me>
Co-committed-by: M.V. Hutz <git@maximhutz.me>

terraform/outputs.tf

@@ -1,11 +1,17 @@
 output "server_ip" {
   description = "The public address of the server."
-  value = hcloud_server.server_instance.ipv4_address
-  sensitive = false
+  value       = hcloud_server.server_instance.ipv4_address
+  sensitive   = false
 }
 
 output "server_fqdn" {
   description = "The public domain of the server."
-  value = "${local.subdomain}.${local.domain}"
-  sensitive = false
+  value       = "${local.subdomain}.${local.domain}"
+  sensitive   = false
+}
+
+output "runner_ip" {
+  description = "The private network address of the runner."
+  value       = local.runner_ip
+  sensitive   = false
 }