feat: migrate to Gitea, productize Helm chart, unify version

- CI: replace GitLab pipeline with Gitea Actions (.gitea/workflows/release.yaml);
  publish .deb/image/hosted/chart to Gitea registries; gate image+hosted on .deb
  (needs + registry pre-check)
- drop connectone/Nexus; apt now from the Gitea Debian registry
- single version source (/VERSION=3.2.8); CI enforces .env/Chart consistency
- restructure: build/->packaging/deb, root Dockerfile->packaging/image,
  hosted/->packaging/hosted, .kube/->charts/freeradius
- Helm chart: documented values, DB password via Secret/$ENV, configurable
  scheduling/persistence; remove plaintext creds and hostPath PV
- gitignore *.env_cnf; docs for hosted (RU)/helm/root + agent KB sync

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

packaging/image/Dockerfile

@@ -0,0 +1,55 @@
+# Runtime image for the custom FreeRADIUS build.
+# Installs the pre-built .deb packages from the Gitea Debian registry and bakes
+# the shared configs. Build context MUST be the repo root:
+#   docker build -f packaging/image/Dockerfile -t <ref> .
+#
+# Version is pinned via PKG_VERSION (CI derives it from /VERSION, e.g. 3.2.8+git).
+FROM ubuntu:24.04
+WORKDIR /tmp
+ARG out_dir=/etc/freeradius
+ARG PKG_VERSION=3.2.8+git
+
+# Gitea Debian package registry (override for a different instance/owner).
+ARG DEB_REGISTRY=https://git.ahax86.ru/api/packages/pub/debian
+ARG DEB_DISTRIBUTION=noble
+ARG DEB_COMPONENT=main
+
+COPY packaging/image/local-noble.list /etc/apt/sources.list.d/ubuntu.sources
+RUN apt-get update && apt-get install -y apt-transport-https ca-certificates curl gpg
+
+# Register the Gitea Debian registry (public read assumed for owner "pub").
+RUN install -d /etc/apt/keyrings && \
+    curl -fsSL "${DEB_REGISTRY}/repository.key" -o /etc/apt/keyrings/gitea-pub.asc && \
+    echo "deb [signed-by=/etc/apt/keyrings/gitea-pub.asc] ${DEB_REGISTRY} ${DEB_DISTRIBUTION} ${DEB_COMPONENT}" \
+      > /etc/apt/sources.list.d/gitea-freeradius.list
+
+RUN apt-get update && apt-get install -y \
+      libfreeradius3=${PKG_VERSION} freeradius-common=${PKG_VERSION} \
+      freeradius-postgresql=${PKG_VERSION} freeradius-rest=${PKG_VERSION} \
+      freeradius-utils=${PKG_VERSION} freeradius=${PKG_VERSION} && \
+    apt autoremove --purge -y && apt-get clean && \
+    rm -f /etc/apt/sources.list.d/gitea-freeradius.list
+
+# Bake the shared configs (kept under packaging/hosted/config).
+COPY packaging/hosted/config /tmp/config
+RUN cp /tmp/config/radiusd.conf $out_dir/radiusd.conf && \
+    cp /tmp/config/dictionary $out_dir/dictionary && \
+    cp /tmp/config/clients.conf $out_dir/clients.conf && \
+    cp /tmp/config/mods-enabled/raw $out_dir/mods-enabled/raw && \
+    cp /tmp/config/sites-enabled/dynamic-clients $out_dir/sites-enabled/dynamic-clients && \
+    rm -f $out_dir/sites-enabled/inner-tunnel && \
+    rm -f $out_dir/mods-enabled/eap && \
+    rm -f $out_dir/mods-enabled/proxy_rate_limit
+
+# Enable delay_reject.
+RUN rm -f $out_dir/mods-enabled/delay && \
+    ln -s $out_dir/mods-available/delay $out_dir/mods-enabled/delay
+
+ADD packaging/image/entrypoint.sh /usr/bin/entrypoint.sh
+RUN chmod a+x /usr/bin/entrypoint.sh && chmod -R 750 $out_dir && chown -R freerad:root $out_dir && \
+    mv /etc/freeradius/certs /tmp && \
+    rm -rf /tmp/config
+
+WORKDIR /etc/freeradius
+ENTRYPOINT ["/usr/bin/entrypoint.sh"]
+CMD ["freeradius", "-f"]

packaging/image/entrypoint.sh

@@ -0,0 +1,22 @@
+#!/bin/bash
+
+set -e
+
+echo "copy configs"
+cp -r /configs/default /etc/freeradius/sites-enabled/default
+cp -r /configs/sql /etc/freeradius/mods-enabled/sql
+cp -r /configs/rest /etc/freeradius/mods-enabled/rest
+
+if [ ! "$(ls -A /etc/freeradius/certs)" ]; then
+  echo "Copying certificates"
+  mkdir -p /etc/freeradius/certs/
+  cp -r /tmp/certs/ /etc/freeradius/certs/
+fi
+
+echo "chowning..."
+chown -R freerad:root /etc/freeradius && chmod -R 750 /etc/freeradius
+
+echo "running"
+exec "$@"
+
+

packaging/image/local-noble.list

@@ -0,0 +1,13 @@
+Types: deb
+URIs: http://ru.archive.ubuntu.com/ubuntu/
+Suites: noble noble-updates noble-backports
+Components: main universe restricted multiverse
+Signed-By: /usr/share/keyrings/ubuntu-archive-keyring.gpg
+
+## Ubuntu security updates. Aside from URIs and Suites,
+## this should mirror your choices in the previous section.
+Types: deb
+URIs: http://ru.archive.ubuntu.com/ubuntu/
+Suites: noble-security
+Components: main universe restricted multiverse
+Signed-By: /usr/share/keyrings/ubuntu-archive-keyring.gpg