feat: add configuration templates

- docker-compose-gitea.yml.tpl: Gitea + SQLite container
- app.ini.tpl: Gitea config (INSTALL_LOCK, Actions enabled, no registration)
- docker-compose-runner.yml.tpl: act_runner Docker container (Linux)
- runner-config.yaml.tpl: act_runner config (capacity=1, timeout=3h)
- com.gitea.runner.plist.tpl: macOS launchd service for native runner
- nginx-gitea.conf.tpl: Nginx reverse proxy with SSL/WebSocket support
- workflows/security-scan.yml.tpl: Semgrep + Trivy + Gitleaks workflow

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

templates/docker-compose-runner.yml.tpl

@@ -0,0 +1,15 @@
+version: "3"
+
+services:
+  runner:
+    image: gitea/act_runner:${ACT_RUNNER_VERSION}
+    container_name: gitea-runner-${RUNNER_NAME}
+    restart: unless-stopped
+    environment:
+      - GITEA_INSTANCE_URL=${GITEA_INTERNAL_URL}
+      - GITEA_RUNNER_REGISTRATION_TOKEN=${GITEA_RUNNER_REGISTRATION_TOKEN}
+      - GITEA_RUNNER_NAME=${RUNNER_NAME}
+      - GITEA_RUNNER_LABELS=${RUNNER_LABELS}
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock
+      - ${RUNNER_DATA_PATH}:/data