feat: add Gitea Actions runner (#6)

## Summary
- Adds a private runner server on the Hetzner private network (no public IP)
- NAT through the gitea server for outbound internet access via `hcloud_network_route` and iptables forwarding rules
- Runner connects to gitea over HTTPS on the private network with TLS verification disabled
- Includes Taskfile commands for runner deployment and SSH access

## Test plan
- [x] Runner registers with gitea instance
- [x] Private network connectivity verified
- [ ] Run a test workflow to confirm end-to-end CI

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Reviewed-on: #6
Co-authored-by: M.V. Hutz <git@maximhutz.me>
Co-committed-by: M.V. Hutz <git@maximhutz.me>

terraform/variables.tf

@@ -5,6 +5,12 @@ locals {
 
   domain    = "maximhutz.com"
   subdomain = "git"
+
+  network_zone = "eu-central"
+  network_cidr = "10.0.0.0/16"
+  subnet_cidr  = "10.0.1.0/24"
+  server_ip    = "10.0.1.2"
+  runner_ip    = "10.0.1.3"
 }
 
 # ---------------------------------------------------------------------------- #