Wire Forgejo SMTP password from OpenBao via External Secrets

Add forgejo-mailer ExternalSecret, inject GITEA__mailer__PASSWD from the
synced Secret, remove mailer from SOPS overlay, and add ESO bootstrap targets.

tools/forgejo-helm-secrets.sh

@@ -0,0 +1,42 @@
+#!/usr/bin/env bash
+# Emit Helm values for Forgejo DB + admin secrets (no mailer — OpenBao/ESO owns SMTP).
+set -euo pipefail
+
+ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+SECRETS_FILE="${FORGEJO_SECRETS:-$ROOT_DIR/helm/forgejo-secrets.sops.yaml}"
+KUBECONFIG="${KUBECONFIG:-$HOME/.kube/config-hosteurope}"
+
+emit_from_sops() {
+  sops -d "$SECRETS_FILE" | python3 -c "
+import sys, yaml
+data = yaml.safe_load(sys.stdin) or {}
+mailer = data.get('gitea', {}).get('config', {}).get('mailer')
+if mailer:
+    data['gitea']['config'].pop('mailer', None)
+yaml.dump(data, sys.stdout, default_flow_style=False)
+"
+}
+
+emit_from_cluster() {
+  python3 -c "
+import json, os, subprocess, sys, yaml
+os.environ['KUBECONFIG'] = '${KUBECONFIG}'
+vals = json.loads(subprocess.check_output(
+    ['helm', 'get', 'values', 'forgejo', '-n', 'forgejo', '-o', 'json'], text=True))
+g = vals.get('gitea', {})
+yaml.dump({
+    'gitea': {
+        'admin': {'password': g.get('admin', {}).get('password', '')},
+        'config': {
+            'database': {'PASSWD': g.get('config', {}).get('database', {}).get('PASSWD', '')},
+        },
+    }
+}, sys.stdout, default_flow_style=False)
+"
+}
+
+if command -v sops >/dev/null 2>&1 && sops -d "$SECRETS_FILE" >/dev/null 2>&1; then
+  emit_from_sops
+else
+  emit_from_cluster
+fi