deploy/gitea: Gitea behind traefik, rproxy and servewaf, with its test (closes #178)

deploy/gitea/compose.yaml runs traefik, stock Gitea 1.27.3, rproxy and
servewaf on one network with a fixed subnet. Its containers skip
servewaf's checks; the network's gateway is left out of that range.
rproxy takes uploads of 2 GiB and 30 minutes, and cuts responses at 15
minutes. script/gitea-setup (make gitea-setup) brings the setup up and
checks it. docs/gitea.md is rewritten around the setup.

Judgement call: the Core Rule Set runs in detect mode, so it refuses nothing.
Judgement call: traefik serves its own certificate; no certificate resolver.
Partially verified: the image build failed three runs on Ubuntu's snapshot
service, so the checks ran only against a stand-in image with the same binary.

Model: deepseek-v4-pro

Makefile

@@ -1,12 +1,13 @@
 .PHONY: bootstrap setup test lint fmt fmt-check tidy check docker hooks build \
-	run example-app gitea-requests
+	run example-app gitea-requests gitea-setup
 
 # Makefile targets are thin shims; the implementations live in script/
 # per the scripts-to-rule-them-all pattern (see the Entrypoints section
 # of README.md). tidy writes go.mod and go.sum as `go mod tidy` does,
 # which test checks. build and run are for working on the code by hand;
 # example-app checks the image with an app built on it; gitea-requests
-# reports the gitea requests the Core Rule Set refuses at the defaults.
+# reports the gitea requests the Core Rule Set refuses at the defaults;
+# gitea-setup checks the setup in deploy/gitea.
 
 bootstrap:
 	@script/bootstrap
@@ -49,3 +50,6 @@ example-app:
 
 gitea-requests:
 	@script/gitea-requests
+
+gitea-setup:
+	@script/gitea-setup