feat: Gitea deployment with 1Password and Caddy

Complete infrastructure deployment including:
- Docker Compose templates with 1Password integration (op://)
- Caddy reverse proxy configuration for git.terraphim.cloud
- Automated deployment script (deploy-to-bigbox.sh)
- Comprehensive documentation and deployment article
- Network isolation: Public (Gitea) + Tailscale (Prometheus/S3)
- Security: No hardcoded secrets, all via 1Password

Services deployed:
- Gitea 1.22.6 (Git hosting)
- PostgreSQL 15 (Database)
- SeaweedFS (S3-compatible storage)
- Prometheus (Monitoring)

Excludes:
- docker-compose.yml (contains resolved secrets)
- s3_config.json (contains resolved secrets)
- Data directories (gitea/, postgres/, seaweedfs/)

Refs: Private deployment on bigbox with TerraphimPlatform vault

docker-compose.yml.template

@@ -0,0 +1,134 @@
+version: "3"
+# Template file - use 'op inject' to generate docker-compose.yml
+# This file contains 1Password references (op://) and should NOT be deployed directly
+# Run: op inject --in-file docker-compose.yml.template --out-file docker-compose.yml
+#
+# Network Configuration:
+# - Gitea: Public via Caddy (git.terraphim.cloud) -> localhost:3000
+# - Prometheus: Tailscale only (100.106.66.7:9000)
+# - S3: Tailscale only (100.106.66.7:8333)
+# - Other SeaweedFS: Internal Docker network only (no external exposure)
+
+networks:
+  gitea:
+    external: false
+
+services:
+  server:
+    image: gitea/gitea:1.22.6
+    container_name: gitea
+    environment:
+      - USER_UID=1000
+      - USER_GID=1000
+      - GITEA__database__DB_TYPE=postgres
+      - GITEA__database__HOST=db:5432
+      - GITEA__database__NAME=gitea
+      - GITEA__database__USER=gitea
+      - GITEA__database__PASSWD=op://TerraphimPlatform/gitea-postgres/password
+      - GITEA__actions__ENABLE=true
+      - GITEA__repository__LFS_START_SERVER=true
+      - GITEA__repository__LFS_CONTENT_PATH=/data/lfs
+      - GITEA__storage__type=minio
+      - GITEA__storage__MINIO_ACCESS_KEY_ID=op://TerraphimPlatform/gitea-s3/access-key
+      - GITEA__storage__MINIO_SECRET_ACCESS_KEY=op://TerraphimPlatform/gitea-s3/secret-key
+      - GITEA__storage__MINIO_BUCKET=gitea
+      - GITEA__storage__MINIO_LOCATION=us-east-1
+      # Use Tailscale IP for internal S3 access
+      - GITEA__storage__MINIO_ENDPOINT=http://100.106.66.7:8333
+      - GITEA__storage__MINIO_INSECURE_SKIP_VERIFY=false
+      - GITEA__storage__MINIO_USE_SSL=false
+      - GITEA__storage__SERVE_DIRECT=true
+    user: "1000:1000"
+    restart: always
+    networks:
+      - gitea
+    volumes:
+      - ./gitea:/data
+      - /etc/timezone:/etc/timezone:ro
+      - /etc/localtime:/etc/localtime:ro
+    ports:
+      # Gitea HTTP - localhost only (accessed via Caddy reverse proxy)
+      - "127.0.0.1:3000:3000"
+      # Gitea SSH - exposed on all interfaces
+      - "222:22"
+    depends_on:
+      - db
+      - s3
+
+  db:
+    image: postgres:15
+    restart: always
+    environment:
+      - POSTGRES_USER=gitea
+      - POSTGRES_PASSWORD=op://TerraphimPlatform/gitea-postgres/password
+      - POSTGRES_DB=gitea
+    networks:
+      - gitea
+    volumes:
+      - ./postgres:/var/lib/postgresql/data
+    # No external ports - internal Docker network only
+
+  master:
+    image: chrislusf/seaweedfs
+    # No external ports - internal Docker network only
+    command: "master -ip=master -ip.bind=0.0.0.0 -metricsPort=9324"
+    networks:
+      - gitea
+
+  volume:
+    image: chrislusf/seaweedfs
+    # No external ports - internal Docker network only
+    command: 'volume -mserver="master:9333" -ip.bind=0.0.0.0 -port=8080 -metricsPort=9325'
+    depends_on:
+      - master
+    volumes:
+      - ./seaweedfs:/data
+    networks:
+      - gitea
+
+  filer:
+    image: chrislusf/seaweedfs
+    # No external ports - internal Docker network only
+    command: 'filer -master="master:9333" -ip.bind=0.0.0.0 -metricsPort=9326'
+    tty: true
+    stdin_open: true
+    depends_on:
+      - master
+      - volume
+    volumes:
+      - ./seaweedfs_filter:/data
+    networks:
+      - gitea
+
+  s3:
+    image: chrislusf/seaweedfs
+    container_name: s3storage
+    hostname: s3storage
+    ports:
+      # Bind to Tailscale interface only (100.106.66.7)
+      # Accessible only within Tailscale network, not public internet
+      - "100.106.66.7:8333:8333"
+      - "100.106.66.7:9327:9327"
+    command: 's3 -config=/etc/seaweedfs/s3.json -filer="filer:8888" -ip.bind=0.0.0.0 -metricsPort=9327'
+    depends_on:
+      - master
+      - volume
+      - filer
+    volumes:
+      - ./s3_config.json:/etc/seaweedfs/s3.json
+    networks:
+      - gitea
+
+  prometheus:
+    image: prom/prometheus:v2.21.0
+    ports:
+      # Bind to Tailscale interface only (100.106.66.7)
+      # Accessible only within Tailscale network, not public internet
+      - "100.106.66.7:9000:9090"
+    volumes:
+      - ./prometheus:/etc/prometheus
+    command: --web.enable-lifecycle --config.file=/etc/prometheus/prometheus.yml
+    depends_on:
+      - s3
+    networks:
+      - gitea