Run Gitea as a rootless Podman Quadlet, with git over SSH on the host's sshd

Replaces the docker_container deployment on monoco with a Quadlet systemd user
unit on emily, and moves state from /var/lib/gitea to ~/podman-data/gitea. Gitea
is SQLite -- the live app.ini on monoco says DB_TYPE = sqlite3 with
PATH = /data/gitea/gitea.db -- so there is no postgres role and the database
travels inside the data tree.

git-over-SSH is the part that could not simply be moved. Port 22 stays the host's
sshd, so no client changes its remote, but the second hop does: the Docker-era
design sshed into an sshd *inside* the container, and under keep-id that sshd runs
as a subuid which cannot read the authorized_keys Gitea writes as tanshu. It is
replaced by a `podman exec`, reached through a shim sshd runs as a new `git` login
user, a one-command sudoers rule, and an AuthorizedKeysCommand that hands sshd the
key file without the ownership check StrictModes would otherwise apply.

Two things stopped it starting, and both only showed up when it was run:

keep-id runs the container *process* as the uid it maps, not just the file
ownership, so the whole container came up as `git` while the image's start-up is
written to begin as root. /usr/bin/entrypoint rewrites /etc/passwd,
/etc/s6/gitea/setup prepares /data before the run script `su-exec git`s the
server, and the image's own CMD is s6-svscan, which has to create
.s6-svscan/lock inside root-owned /etc/s6. The container died on the last two --
"sed: can't create temp file '/etc/passwdXXXXXX': Permission denied" and
"s6-svscan: fatal: unable to open .s6-svscan/lock: Permission denied" -- and
Restart=always turned that into a crash loop, which `is-active` reports as
`activating` rather than as a failure. User=0 restores root for the start-up and
leaves the mapping alone: the server still runs as git through su-exec, which is
what satisfies mustNotRunAsRoot. (nextcloud.container carries the same pair for
the same reason.)

The `ssh/` directory under /data is only ever a mount point -- the in-image
sshd's host keys are mounted over it from ~/podman-data/gitea-sshd -- so it is
hidden inside the container and nothing ever chowns it. When Podman has to create
it, it lands in the data tree owned by the subuid, and the role's own "nothing
here belongs to another user" check fails on it, correctly. Creating it in the
role first is what keeps the tree wholly tanshu's.

Start, is-active and the health check are now one block whose rescue dumps
status, journal and podman logs, because they fail the same way: `systemctl
start` reports success as soon as systemd holds the unit, so a container that
dies a second later surfaces only as `activating` -- which is exactly how the two
failures above were reported, with the reason in the journal and nowhere the play
looked.

Verified on emily: the play runs to ok=27/changed=7/failed=0, the health check
and the stray-owner assertion both pass, and the ssh second hop still returns the
container's Gitea 28.1.0 through the wrapper. The role's comments and the readme
were corrected where they explained the old failures as EPERM from the root
phases: container root holds the usual capabilities inside its user namespace, so
those phases succeed and leave subuid-owned files behind, which is the real reason
the tree is created up front. The readme's list of "expected" chmod EPERM lines is
gone, because the log is clean. The data directory was emptied of the fresh
app.ini afterwards and the unit left stopped, ready for the copy from monoco.

gitea/roles/ssh/templates/gitea-authorized-keys.j2

@@ -0,0 +1,29 @@
+#!/bin/sh
+# sshd's source for the `{{ git_user }}` user's authorized_keys.
+# Managed by Ansible (gitea/roles/ssh). Do not edit by hand.
+#
+# Gitea maintains that file from inside its container, where it runs as
+# {{ podman_user }} (container uid {{ gitea_uid }} is mapped onto that user by
+# keep-id), so the file belongs to {{ podman_user }} and not to `{{ git_user }}`.
+# sshd refuses a file the login user does not own — that is StrictModes — and
+# StrictModes cannot be relaxed for one user, because sshd_config(5) does not
+# allow the option inside a Match block. So the file is fed to sshd through
+# AuthorizedKeysCommand instead: sshd uses whatever this prints, and applies no
+# ownership check to it.
+#
+# Only lines that force the passthrough shim are printed. Gitea's file also
+# carries an unforced entry for the "Gitea Host Key" that the Docker-era
+# deployment needed so that its shim could ssh into a second sshd inside the
+# container. Nothing reads that entry any more, and printing it would hand an
+# interactive `{{ git_user }}` login on this host — and therefore rootless
+# Podman, through the sudoers drop-in — to anyone holding a copy of that key,
+# a backup included.
+#
+# The pattern is exactly the shape Gitea writes. If it ever changes,
+# git-over-SSH stops working while HTTPS keeps serving, and
+#   podman exec {{ container_name }} cat /data/git/.ssh/authorized_keys
+# shows what Gitea writes now.
+keys="{{ host_directory }}/git/.ssh/authorized_keys"
+[ -r "$keys" ] || exit 0
+grep -E '^command="{{ shim_path }} ' "$keys"
+exit 0