feat: add Gitea Actions runner on private compute

Adds a private runner server on the Hetzner private network with NAT
through the gitea server for outbound internet access. Includes
Terraform resources, Ansible playbooks, and iptables forwarding rules.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

gitea/config/dev.app.ini

@@ -96,6 +96,9 @@ DEFAULT_TRUST_MODEL = committer
 [oauth2]
 JWT_SECRET = x-----------------------------------------x
 
+[actions]
+ENABLED = true
+
 [storage]
 STORAGE_TYPE = minio
 MINIO_ENDPOINT = localstack:4566