feat: add configuration templates

- docker-compose-gitea.yml.tpl: Gitea + SQLite container
- app.ini.tpl: Gitea config (INSTALL_LOCK, Actions enabled, no registration)
- docker-compose-runner.yml.tpl: act_runner Docker container (Linux)
- runner-config.yaml.tpl: act_runner config (capacity=1, timeout=3h)
- com.gitea.runner.plist.tpl: macOS launchd service for native runner
- nginx-gitea.conf.tpl: Nginx reverse proxy with SSL/WebSocket support
- workflows/security-scan.yml.tpl: Semgrep + Trivy + Gitleaks workflow

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

templates/app.ini.tpl

@@ -0,0 +1,42 @@
+; Gitea configuration — rendered from app.ini.tpl
+; Do not edit directly on the server — re-render and redeploy instead.
+
+[server]
+ROOT_URL         = https://${GITEA_DOMAIN}/
+DOMAIN           = ${GITEA_DOMAIN}
+SSH_DOMAIN       = ${GITEA_DOMAIN}
+HTTP_PORT        = 3000
+DISABLE_SSH      = false
+START_SSH_SERVER = true
+SSH_PORT         = 22
+LFS_START_SERVER = true
+
+[database]
+DB_TYPE = ${GITEA_DB_TYPE}
+PATH    = /data/gitea/gitea.db
+
+[security]
+INSTALL_LOCK = true
+SECRET_KEY   = ${GITEA_SECRET_KEY}
+
+[service]
+DISABLE_REGISTRATION              = true
+REQUIRE_SIGNIN_VIEW               = false
+DEFAULT_ALLOW_CREATE_ORGANIZATION = false
+
+[repository]
+DEFAULT_BRANCH = main
+
+[actions]
+ENABLED = true
+
+[log]
+MODE  = console
+LEVEL = info
+
+[ui]
+DEFAULT_THEME = gitea-auto
+SHOW_USER_EMAIL = false
+
+[mailer]
+ENABLED = false