Public repos are now browsable/clonable anonymously (HTTPS) and over SSH,
proxied through the Hetzner VPS. Unlike other public apps this is
deliberately not behind the oauth2-proxy/Zitadel gate, since Forgejo
already enforces its own per-repo visibility. Root redirects to the
.profile landing page. Documents the REQUIRE_SIGNIN_VIEW gotcha and the
Zitadel OIDC redirect_uri fix needed whenever FORGEJO_DOMAIN changes.
Added a Technitium A record pointing at the Forgejo LXC directly
(SSH can't go through the Caddy wildcard CNAME), so git-over-SSH URLs
read ssh://git@forgejo.home.brianpooe.com/... instead of the raw IP.
All 5 hosts' remotes/SSH config updated to match.
Relocated LXC 114's own admin sshd to port 2200 (systemd ssh.socket
override) to free port 22 for Forgejo's git-SSH, dropping the ugly
:2222 from every clone URL. Updated the 5 hosts' remotes/SSH config
and the corresponding UniFi rules to match.
GitHub mirroring is no longer needed now that Forgejo is the primary
remote. Drops the gitea-mirror service, its volume, env vars, Caddy
site, and firewall rule; docs updated to match.
Self-hosted Git service (Postgres-backed) plus gitea-mirror for automatic
GitHub repo mirroring. Storage split follows the Paperless pattern: DB and
app config on local disk, git objects/LFS/attachments/avatars on the UNAS
forgejo_data share. Wired into the Makefile, root README, and UNAS NFS docs;
adds Caddy routes for git.<domain> and git-mirror.<domain>.
