feat: migrate to Gitea, productize Helm chart, unify version

- CI: replace GitLab pipeline with Gitea Actions (.gitea/workflows/release.yaml);
  publish .deb/image/hosted/chart to Gitea registries; gate image+hosted on .deb
  (needs + registry pre-check)
- drop connectone/Nexus; apt now from the Gitea Debian registry
- single version source (/VERSION=3.2.8); CI enforces .env/Chart consistency
- restructure: build/->packaging/deb, root Dockerfile->packaging/image,
  hosted/->packaging/hosted, .kube/->charts/freeradius
- Helm chart: documented values, DB password via Secret/$ENV, configurable
  scheduling/persistence; remove plaintext creds and hostPath PV
- gitignore *.env_cnf; docs for hosted (RU)/helm/root + agent KB sync

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

README.md

@@ -1,20 +1,87 @@
-# freeradius
+# FreeRADIUS
 
-build:
-```bash
-cd build
-docker build . -t freerad_builder:3.2.x -f Dockerfile_build
-docker run -e DEB_USER=${DEB_USER} DEB_PASS="${DEB_PASS}" freerad_builder:3.2.x ./upload.sh
+Packaging and delivery of a custom FreeRADIUS 3.2.x build for
+hotspot / captive-portal scenarios. There is no application code here — the repo
+builds upstream FreeRADIUS with the extra `rlm_raw` module and ships it to two
+runtimes (bare-metal and Kubernetes) via a Gitea-hosted registry.
+
+## Single source of version truth
+
+[`VERSION`](VERSION) holds the FreeRADIUS release (`3.2.8`). CI derives everything
+from it: the build tag `release_3_2_8`, the package pin `3.2.8+git`, the chart
+`appVersion`. CI fails if `packaging/hosted/.env` or `charts/freeradius/Chart.yaml`
+drift from `VERSION`.
+
+## Layout
+
+```
+VERSION                       single source of the FreeRADIUS version
+.gitea/workflows/release.yaml  manual release pipeline (Gitea Actions)
+packaging/
+  deb/      build the .deb from FreeRADIUS source + rlm_raw, upload to registry
+  image/    runtime container image (installs the .deb, bakes configs)
+  hosted/   bare-metal / VM install (install.sh, update.sh, config, cron)
+charts/
+  freeradius/  productized Helm chart
 ```
 
-label nodes:
-```bash
-kubectl label node connect-prod-0 freeradius=enabled
+## Artifacts (Gitea, owner `pub`)
+
+| Artifact | Registry |
+|----------|----------|
+| `.deb` packages | `https://git.ahax86.ru/api/packages/pub/debian` (`noble main`) |
+| Container image | `git.ahax86.ru/pub/freeradius:<version>` |
+| Hosted bundle | `.../api/packages/pub/generic/hosted/<version>/hosted.tar.gz` |
+| Helm chart | `https://git.ahax86.ru/api/packages/pub/helm` |
+
+## Release flow (`.gitea/workflows/release.yaml`, manual)
+
+```
+prepare ──► build-deb ──► build-image ──► package-helm
+                     └──► package-hosted
 ```
 
-remove 
-```bash
+The `.deb` is the prerequisite: `build-image` and `package-hosted` both `needs:
+build-deb` **and** verify the pinned version exists in the Debian registry
+before running. Trigger from Gitea → Actions → `release` → *Run workflow*.
 
-sudo apt-mark unhold libfreeradius3 freeradius-common freeradius-postgresql freeradius-rest freeradius-utils freeradius
-sudo dpkg --force-overwrite --purge freeradius-common freeradius-config freeradius-python3 freeradius libfreeradius3 freeradius-postgresql freeradius-rest freeradius-utils && sudo rm -rf /etc/freeradius && sudo rm -rf /usr/lib/freeradius
-```
+### CI setup (Gitea)
+
+1. **Runner.** Enable Actions for the repo and register an `ubuntu-latest` runner
+   (`act_runner`) with Docker available. If your runner uses a different label,
+   change `runs-on` in the workflow.
+2. **Access token.** Gitea → avatar → *Settings* → *Applications* →
+   *Manage Access Tokens* → *Generate New Token*. Scopes: `write:package` and
+   `read:package`. Copy the token (shown once).
+3. **Repo secrets.** Repo → *Settings* → *Actions* → *Secrets* → *Add Secret*:
+   - `PACKAGES_USER` — your Gitea username (the token owner).
+   - `PACKAGES_TOKEN` — the token from step 2.
+
+These secrets are used to push to the container / Debian / generic / Helm
+registries and to read the Debian `Packages` index in the gate check.
+
+## Local builds (no upload)
+
+```bash
+# .deb builder image
+docker build packaging/deb -f packaging/deb/Dockerfile \
+  --build-arg RADIUS_TAG=release_3_2_8 --build-arg RLM_RAW_BRANCH=v3.2.4 \
+  -t freerad-builder:3.2.8
+
+# runtime image (context = repo root; pulls .deb from the Debian registry)
+docker build -f packaging/image/Dockerfile --build-arg PKG_VERSION=3.2.8+git -t freeradius:3.2.8 .
+
+# chart
+helm lint charts/freeradius --set db.password=test
+helm template freeradius charts/freeradius --set db.password=test
+```
+
+## Deployment docs
+
+- Bare-metal / VM: [packaging/hosted/README.md](packaging/hosted/README.md)
+- Kubernetes (Helm): [charts/freeradius/README.md](charts/freeradius/README.md)
+
+## Internals
+
+See [agent/INDEX.md](agent/INDEX.md) for invariants, hosts/ports, backends and
+known constraints.