feat: add configuration templates

- docker-compose-gitea.yml.tpl: Gitea + SQLite container
- app.ini.tpl: Gitea config (INSTALL_LOCK, Actions enabled, no registration)
- docker-compose-runner.yml.tpl: act_runner Docker container (Linux)
- runner-config.yaml.tpl: act_runner config (capacity=1, timeout=3h)
- com.gitea.runner.plist.tpl: macOS launchd service for native runner
- nginx-gitea.conf.tpl: Nginx reverse proxy with SSL/WebSocket support
- workflows/security-scan.yml.tpl: Semgrep + Trivy + Gitleaks workflow

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

templates/com.gitea.runner.plist.tpl

@@ -0,0 +1,38 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN"
+  "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+  <key>Label</key>
+  <string>com.gitea.runner.${RUNNER_NAME}</string>
+
+  <key>ProgramArguments</key>
+  <array>
+    <string>${RUNNER_DATA_PATH}/act_runner</string>
+    <string>daemon</string>
+    <string>--config</string>
+    <string>${RUNNER_DATA_PATH}/config.yaml</string>
+  </array>
+
+  <key>WorkingDirectory</key>
+  <string>${RUNNER_DATA_PATH}</string>
+
+  <key>RunAtLoad</key>
+  <true/>
+
+  <key>KeepAlive</key>
+  <true/>
+
+  <key>StandardOutPath</key>
+  <string>${RUNNER_DATA_PATH}/runner.out.log</string>
+
+  <key>StandardErrorPath</key>
+  <string>${RUNNER_DATA_PATH}/runner.err.log</string>
+
+  <key>EnvironmentVariables</key>
+  <dict>
+    <key>PATH</key>
+    <string>/usr/local/bin:/usr/bin:/bin:/usr/sbin:/sbin</string>
+  </dict>
+</dict>
+</plist>