feat: add Phase 1 — Gitea on Unraid

- phase1_gitea_unraid.sh: 9-step deploy (dirs, docker-compose, app.ini,
  container start, wait, admin user, API token, save to .env, create org).
  Every step has idempotency check — running twice changes nothing.
- phase1_post_check.sh: 5 independent verification checks
- phase1_teardown.sh: stop container + optionally remove data, with prompts

Also adds inline comments to lib/common.sh and preflight.sh explaining
WHY decisions were made (SSH flags, API tmpfile pattern, port checks, etc.)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

preflight.sh

@@ -15,7 +15,9 @@ PASS_COUNT=0
 FAIL_COUNT=0
 
 # ---------------------------------------------------------------------------
-# Check helper — runs a check, tracks pass/fail
+# Check helper — runs a check function, tracks pass/fail count.
+# Intentionally does NOT exit on failure — we want to run ALL 16 checks
+# so the user sees every issue at once, not one at a time.
 # ---------------------------------------------------------------------------
 check() {
   local num="$1" description="$2"
@@ -157,6 +159,8 @@ fi
 
 # ---------------------------------------------------------------------------
 # Check 10: Port free on Unraid
+# Uses ss (socket statistics) to check if any process is listening on the port.
+# The ! negates the grep — we PASS if the port is NOT found in use.
 # ---------------------------------------------------------------------------
 check_port_unraid() {
   local port="${UNRAID_GITEA_PORT:-3000}"