sops-nix bootstrap + Forgejo at git.tyrolize.ch

sops:
- devShell provides ssh-to-age and sets SOPS_AGE_KEY_FILE to
  $REPO/.sops-age-key.txt (gitignored, generated locally).
- .sops.yaml lists laptop + watcher recipients. The watcher recipient is
  derived from /etc/ssh/ssh_host_ed25519_key.pub via ssh-to-age, so the
  watcher decrypts using its SSH host key as the age identity at boot.
- hosts/watcher/secrets.yaml holds an `example` placeholder; sops-install-
  secrets surfaces it at /run/secrets/example (root-only).

Forgejo:
- modules/forgejo.nix enables services.forgejo (sqlite + daily tar.gz
  dump), built-in SSH server on :2222, HTTP on 127.0.0.1:3000.
- modules/website.nix adds the git.tyrolize.ch vhost reverse-proxying to
  localhost. Caddy gets a Let's Encrypt cert automatically.
- terraform/infomaniak/watcher.tf opens :2222 v4+v6 in the security group.
- Admin user `tyro` (role admin) created out-of-band via the gitea CLI.

Both services live on the watcher.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

terraform/infomaniak/watcher.tf

@@ -60,6 +60,27 @@ resource "openstack_networking_secgroup_rule_v2" "https" {
   security_group_id = openstack_networking_secgroup_v2.watcher.id
 }
 
+# Forgejo's built-in SSH server (separate from system sshd on :22).
+resource "openstack_networking_secgroup_rule_v2" "forgejo_ssh_v4" {
+  direction         = "ingress"
+  ethertype         = "IPv4"
+  protocol          = "tcp"
+  port_range_min    = 2222
+  port_range_max    = 2222
+  remote_ip_prefix  = "0.0.0.0/0"
+  security_group_id = openstack_networking_secgroup_v2.watcher.id
+}
+
+resource "openstack_networking_secgroup_rule_v2" "forgejo_ssh_v6" {
+  direction         = "ingress"
+  ethertype         = "IPv6"
+  protocol          = "tcp"
+  port_range_min    = 2222
+  port_range_max    = 2222
+  remote_ip_prefix  = "::/0"
+  security_group_id = openstack_networking_secgroup_v2.watcher.id
+}
+
 resource "openstack_compute_instance_v2" "watcher" {
   name            = "watcher"
   flavor_name     = var.flavor_name