feat: add Gitea Actions runner on private compute

Adds a private runner server on the Hetzner private network with NAT
through the gitea server for outbound internet access. Includes
Terraform resources, Ansible playbooks, and iptables forwarding rules.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

gitea/config/app.ini

@@ -91,6 +91,9 @@ DEFAULT_MERGE_STYLE = merge
 [repository.signing]
 DEFAULT_TRUST_MODEL = committer
 
+[actions]
+ENABLED = true
+
 [storage]
 STORAGE_TYPE = minio
 MINIO_USE_SSL = true