deploy/gitea: Gitea behind traefik, rproxy and servewaf, with its test (closes #178)

deploy/gitea/compose.yaml runs traefik, stock Gitea 1.27.3, rproxy and
servewaf on one network with a fixed subnet. Its containers skip
servewaf's checks; the network's gateway is left out of that range.
rproxy takes uploads of 2 GiB and 30 minutes, and cuts responses at 15
minutes. script/gitea-setup (make gitea-setup) brings the setup up and
checks it. docs/gitea.md is rewritten around the setup.

Judgement call: the Core Rule Set runs in detect mode, so it refuses nothing.
Judgement call: traefik serves its own certificate; no certificate resolver.
Partially verified: the image build failed three runs on Ubuntu's snapshot
service, so the checks ran only against a stand-in image with the same binary.

Model: opus-5-5

README.md

@@ -130,6 +130,9 @@ Point traefik's labels at port 8080 of `rproxy`
 of the app or of `servewaf`. Anything on that network can reach the app around
 `rproxy`, and can ask `servewaf` questions.
 
+`deploy/gitea` holds this setup for gitea behind traefik, as a Docker Compose
+file, which [`docs/gitea.md`](docs/gitea.md) explains.
+
 With no setting, `servewaf` sends the address of every new visitor to GeoJS, a
 web service, to find its country and network. `SWWAF_LOOKUP_SOURCE=off` sends
 nothing. `SWWAF_LOOKUP_SOURCE=file`, with `SWWAF_LOOKUP_DB_PATH` naming a
@@ -380,6 +383,10 @@ on the host.
   with each. Needs network access, and a docker daemon that pushes to a registry
   on `localhost` over plain HTTP. [`docs/gitea.md`](docs/gitea.md) records the
   results. `make gitea-requests`.
+- `script/gitea-setup`: builds the image, brings up the setup in `deploy/gitea`,
+  and checks it as [`docs/gitea.md`](docs/gitea.md) describes. Then it removes
+  the containers, the network, the volumes and the image it built. Needs network
+  access. `make gitea-setup`.
 
 ## Rationale
 
@@ -469,7 +476,8 @@ happens when a process stops, moving a port, and the forwarded headers.
 - [`docs/state-files.md`](docs/state-files.md): the state files and what each
   holds.
 - [`docs/image.md`](docs/image.md): what the image holds and how it is pinned.
-- [`docs/gitea.md`](docs/gitea.md): `smallwebwaf` in front of gitea.
+- [`docs/gitea.md`](docs/gitea.md): `smallwebwaf` in front of gitea: the setup
+  in `deploy/gitea`, and what the defaults do there.
 
 ## License