Deploy Forgejo on railiance01 using gitea-charts/gitea 12.5.0

Pin chart to 12.5.0 because 12.6+ calls `gitea config edit-ini`, which
Forgejo 11 lacks. Ingress targets forgejo-gitea-http (Helm release naming).
Smoke test uses GET for /v2/ registry challenge (HEAD returns 405).

manifests/forgejo-ingress.yaml

@@ -0,0 +1,45 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: forgejo
+  namespace: forgejo
+  labels:
+    app.kubernetes.io/name: forgejo
+    app.kubernetes.io/instance: forgejo
+    app.kubernetes.io/part-of: railiance-apps
+    railiance/component: forgejo-public-endpoint
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt-prod
+    traefik.ingress.kubernetes.io/router.entrypoints: websecure
+    traefik.ingress.kubernetes.io/router.tls: "true"
+spec:
+  ingressClassName: traefik
+  rules:
+    - host: forgejo.coulomb.social
+      http:
+        paths:
+          - path: /api/packages
+            pathType: Prefix
+            backend:
+              service:
+                name: forgejo-gitea-http
+                port:
+                  number: 3000
+          - path: /v2
+            pathType: Prefix
+            backend:
+              service:
+                name: forgejo-gitea-http
+                port:
+                  number: 3000
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: forgejo-gitea-http
+                port:
+                  number: 3000
+  tls:
+    - hosts:
+        - forgejo.coulomb.social
+      secretName: forgejo-tls

manifests/forgejo-ssh-nodeport.yaml

@@ -0,0 +1,21 @@
+# Git/SSH access for Forgejo (NodePort pattern mirrors coulombcore Gitea).
+apiVersion: v1
+kind: Service
+metadata:
+  name: forgejo-ssh-nodeport
+  namespace: forgejo
+  labels:
+    app.kubernetes.io/name: forgejo
+    app.kubernetes.io/instance: forgejo
+    app.kubernetes.io/part-of: railiance-apps
+spec:
+  type: NodePort
+  selector:
+    app.kubernetes.io/instance: forgejo
+    app.kubernetes.io/name: gitea
+  ports:
+    - name: ssh
+      port: 22
+      targetPort: 2222
+      nodePort: 30022
+      protocol: TCP