feat: add configuration templates

- docker-compose-gitea.yml.tpl: Gitea + SQLite container
- app.ini.tpl: Gitea config (INSTALL_LOCK, Actions enabled, no registration)
- docker-compose-runner.yml.tpl: act_runner Docker container (Linux)
- runner-config.yaml.tpl: act_runner config (capacity=1, timeout=3h)
- com.gitea.runner.plist.tpl: macOS launchd service for native runner
- nginx-gitea.conf.tpl: Nginx reverse proxy with SSL/WebSocket support
- workflows/security-scan.yml.tpl: Semgrep + Trivy + Gitleaks workflow

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

templates/runner-config.yaml.tpl

@@ -0,0 +1,26 @@
+# act_runner configuration — rendered from runner-config.yaml.tpl
+log:
+  level: info
+
+runner:
+  name: ${RUNNER_NAME}
+  labels:
+    - "${RUNNER_LABELS}:docker://node:20-bookworm"
+  capacity: 1
+  timeout: 3h
+  insecure: false
+  fetch_timeout: 5s
+  fetch_interval: 2s
+
+cache:
+  enabled: true
+  dir: ""
+
+container:
+  network: ""
+  privileged: false
+  options:
+  workdir_parent:
+
+host:
+  workdir_parent: