feat: migrate to Gitea, productize Helm chart, unify version

- CI: replace GitLab pipeline with Gitea Actions (.gitea/workflows/release.yaml);
  publish .deb/image/hosted/chart to Gitea registries; gate image+hosted on .deb
  (needs + registry pre-check)
- drop connectone/Nexus; apt now from the Gitea Debian registry
- single version source (/VERSION=3.2.8); CI enforces .env/Chart consistency
- restructure: build/->packaging/deb, root Dockerfile->packaging/image,
  hosted/->packaging/hosted, .kube/->charts/freeradius
- Helm chart: documented values, DB password via Secret/$ENV, configurable
  scheduling/persistence; remove plaintext creds and hostPath PV
- gitignore *.env_cnf; docs for hosted (RU)/helm/root + agent KB sync

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

packaging/deb/.dockerignore

@@ -0,0 +1,4 @@
+.git/
+.idea/
+*.md
+*.yml

packaging/deb/Dockerfile

@@ -0,0 +1,52 @@
+FROM ubuntu:24.04
+
+ARG DEBIAN_FRONTEND=noninteractive
+#
+#  Install build tools
+#
+
+COPY local-noble.list /etc/apt/sources.list.d/ubuntu.sources
+
+RUN apt-get update && apt-get install -y devscripts equivs git quilt gcc
+
+#
+#  Setup build envs.
+#  Defaults match the repo-wide /VERSION (3.2.8). CI overrides RADIUS_TAG
+#  from VERSION; RLM_RAW_BRANCH is the rlm_raw module branch for this release.
+ARG RADIUS_TAG="release_3_2_8"
+ARG RLM_RAW_BRANCH="v3.2.4"
+
+ENV RADIUS_REPO="https://github.com/FreeRADIUS/freeradius-server.git"
+ENV RADIUS_TAG=${RADIUS_TAG}
+ENV RLM_RAW_REPO="https://github.com/jar3b/rlm_raw.git"
+ENV RLM_RAW_BRANCH=${RLM_RAW_BRANCH}
+
+#
+#  Create build directory
+#
+RUN mkdir -p /usr/local/src/repositories
+WORKDIR /usr/local/src/repositories
+
+RUN git clone --depth 1 --single-branch --branch ${RADIUS_TAG} ${RADIUS_REPO}
+RUN git clone --depth 1 --single-branch --branch ${RLM_RAW_BRANCH} ${RLM_RAW_REPO}
+RUN mv rlm_raw/rlm_raw freeradius-server/src/modules
+
+WORKDIR freeradius-server
+
+#
+#  Install build dependencies
+#
+RUN git checkout ${RADIUS_TAG}; cat VERSION; \
+    if [ -e ./debian/control.in ]; then \
+        debian/rules debian/control; \
+    fi; \
+    echo 'y' | mk-build-deps -irt'apt-get -yV' debian/control
+
+#
+#  Build the server
+#
+RUN make -j2 deb
+
+WORKDIR /usr/local/src/repositories
+ADD upload.sh .
+RUN chmod a+x upload.sh

packaging/deb/local-noble.list

@@ -0,0 +1,13 @@
+Types: deb
+URIs: http://ru.archive.ubuntu.com/ubuntu/
+Suites: noble noble-updates noble-backports
+Components: main universe restricted multiverse
+Signed-By: /usr/share/keyrings/ubuntu-archive-keyring.gpg
+
+## Ubuntu security updates. Aside from URIs and Suites,
+## this should mirror your choices in the previous section.
+Types: deb
+URIs: http://ru.archive.ubuntu.com/ubuntu/
+Suites: noble-security
+Components: main universe restricted multiverse
+Signed-By: /usr/share/keyrings/ubuntu-archive-keyring.gpg

packaging/deb/upload.sh

@@ -0,0 +1,41 @@
+#!/bin/bash
+#
+# Uploads built .deb packages to a Gitea Debian package registry.
+#
+# Required env:
+#   DEB_USER          - Gitea username (token owner)
+#   DEB_PASS          - Gitea access token with the write:package scope
+#
+# Optional env (defaults target git.ahax86.ru / owner "pub"):
+#   DEB_REGISTRY      - registry base URL
+#   DEB_DISTRIBUTION  - apt distribution (default: noble)
+#   DEB_COMPONENT     - apt component    (default: main)
+#
+set -euo pipefail
+
+DEB_REGISTRY="${DEB_REGISTRY:-https://git.ahax86.ru/api/packages/pub/debian}"
+DEB_DISTRIBUTION="${DEB_DISTRIBUTION:-noble}"
+DEB_COMPONENT="${DEB_COMPONENT:-main}"
+
+if [ -z "${DEB_USER:-}" ] || [ -z "${DEB_PASS:-}" ]; then
+  echo "DEB_USER and DEB_PASS must be set" >&2
+  exit 1
+fi
+
+upload_url="${DEB_REGISTRY}/pool/${DEB_DISTRIBUTION}/${DEB_COMPONENT}/upload"
+
+shopt -s nullglob
+debs=(*.deb)
+if [ "${#debs[@]}" -eq 0 ]; then
+  echo "No .deb files found to upload" >&2
+  exit 1
+fi
+
+for file in "${debs[@]}"; do
+  echo "Uploading ${file} -> ${upload_url}"
+  curl -fsSL --user "${DEB_USER}:${DEB_PASS}" \
+    --upload-file "./${file}" \
+    "${upload_url}"
+done
+
+echo "Uploaded ${#debs[@]} package(s)"