Deploy Forgejo on railiance01 using gitea-charts/gitea 12.5.0

Pin chart to 12.5.0 because 12.6+ calls `gitea config edit-ini`, which
Forgejo 11 lacks. Ingress targets forgejo-gitea-http (Helm release naming).
Smoke test uses GET for /v2/ registry challenge (HEAD returns 405).

helm/forgejo-secrets.sops.yaml.template

@@ -0,0 +1,15 @@
+# Encrypt as helm/forgejo-secrets.sops.yaml before production deploy.
+# Contains database PASSWD and admin password consumed by the gitea chart.
+#
+# gitea:
+#   admin:
+#     password: <generated>
+#   config:
+#     database:
+#       PASSWD: <same as forgejo-db-credentials>
+gitea:
+  admin:
+    password: REPLACE_WITH_ADMIN_PASSWORD
+  config:
+    database:
+      PASSWD: REPLACE_WITH_DB_PASSWORD