feat: migrate to Gitea, productize Helm chart, unify version

- CI: replace GitLab pipeline with Gitea Actions (.gitea/workflows/release.yaml);
  publish .deb/image/hosted/chart to Gitea registries; gate image+hosted on .deb
  (needs + registry pre-check)
- drop connectone/Nexus; apt now from the Gitea Debian registry
- single version source (/VERSION=3.2.8); CI enforces .env/Chart consistency
- restructure: build/->packaging/deb, root Dockerfile->packaging/image,
  hosted/->packaging/hosted, .kube/->charts/freeradius
- Helm chart: documented values, DB password via Secret/$ENV, configurable
  scheduling/persistence; remove plaintext creds and hostPath PV
- gitignore *.env_cnf; docs for hosted (RU)/helm/root + agent KB sync

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

packaging/image/Dockerfile

@@ -0,0 +1,55 @@
+# Runtime image for the custom FreeRADIUS build.
+# Installs the pre-built .deb packages from the Gitea Debian registry and bakes
+# the shared configs. Build context MUST be the repo root:
+#   docker build -f packaging/image/Dockerfile -t <ref> .
+#
+# Version is pinned via PKG_VERSION (CI derives it from /VERSION, e.g. 3.2.8+git).
+FROM ubuntu:24.04
+WORKDIR /tmp
+ARG out_dir=/etc/freeradius
+ARG PKG_VERSION=3.2.8+git
+
+# Gitea Debian package registry (override for a different instance/owner).
+ARG DEB_REGISTRY=https://git.ahax86.ru/api/packages/pub/debian
+ARG DEB_DISTRIBUTION=noble
+ARG DEB_COMPONENT=main
+
+COPY packaging/image/local-noble.list /etc/apt/sources.list.d/ubuntu.sources
+RUN apt-get update && apt-get install -y apt-transport-https ca-certificates curl gpg
+
+# Register the Gitea Debian registry (public read assumed for owner "pub").
+RUN install -d /etc/apt/keyrings && \
+    curl -fsSL "${DEB_REGISTRY}/repository.key" -o /etc/apt/keyrings/gitea-pub.asc && \
+    echo "deb [signed-by=/etc/apt/keyrings/gitea-pub.asc] ${DEB_REGISTRY} ${DEB_DISTRIBUTION} ${DEB_COMPONENT}" \
+      > /etc/apt/sources.list.d/gitea-freeradius.list
+
+RUN apt-get update && apt-get install -y \
+      libfreeradius3=${PKG_VERSION} freeradius-common=${PKG_VERSION} \
+      freeradius-postgresql=${PKG_VERSION} freeradius-rest=${PKG_VERSION} \
+      freeradius-utils=${PKG_VERSION} freeradius=${PKG_VERSION} && \
+    apt autoremove --purge -y && apt-get clean && \
+    rm -f /etc/apt/sources.list.d/gitea-freeradius.list
+
+# Bake the shared configs (kept under packaging/hosted/config).
+COPY packaging/hosted/config /tmp/config
+RUN cp /tmp/config/radiusd.conf $out_dir/radiusd.conf && \
+    cp /tmp/config/dictionary $out_dir/dictionary && \
+    cp /tmp/config/clients.conf $out_dir/clients.conf && \
+    cp /tmp/config/mods-enabled/raw $out_dir/mods-enabled/raw && \
+    cp /tmp/config/sites-enabled/dynamic-clients $out_dir/sites-enabled/dynamic-clients && \
+    rm -f $out_dir/sites-enabled/inner-tunnel && \
+    rm -f $out_dir/mods-enabled/eap && \
+    rm -f $out_dir/mods-enabled/proxy_rate_limit
+
+# Enable delay_reject.
+RUN rm -f $out_dir/mods-enabled/delay && \
+    ln -s $out_dir/mods-available/delay $out_dir/mods-enabled/delay
+
+ADD packaging/image/entrypoint.sh /usr/bin/entrypoint.sh
+RUN chmod a+x /usr/bin/entrypoint.sh && chmod -R 750 $out_dir && chown -R freerad:root $out_dir && \
+    mv /etc/freeradius/certs /tmp && \
+    rm -rf /tmp/config
+
+WORKDIR /etc/freeradius
+ENTRYPOINT ["/usr/bin/entrypoint.sh"]
+CMD ["freeradius", "-f"]