Add Gitea SSH setup script and integrate Gitea into partnership/failover

Partnership/gitea_ssh_setup.sh: generates ed25519 keypair, registers public key
  with Gitea API (POST /api/v1/user/keys), tests SSH connection, writes ~/.ssh/config
  entry. Idempotent — skips steps already done. --force regenerates and re-registers.
  Resolves Gitea endpoint from container IP first, falls back to GITEA_DOMAIN.

common.sh: alias HOST*_GITEA_API_TOKEN → GITEA_API_TOKEN in detect_hosts().
  Add to detect_hosts() doc comment.

master.conf: add GITEA_HTTP_PORT=3000 for API endpoint construction.

host1.conf: add HOST1_GITEA_API_TOKEN (fill in from Gitea Settings → Applications).
  Add my-Gitea.xml to HOST1_PARTNERSHIP_AUTH_STACK — onboard pushes it to HOST2.

host2.conf: add Gitea to FALLBACK_HOST2_COVERS_HOST1_TIER1 — starts immediately
  when HOST1 goes down, making the source of truth reachable independently of
  HOST1's auth stack.

common.sh

@@ -391,6 +391,7 @@ validate_int() {
 #   EMBY_CONTAINER            ← HOST*_EMBY_CONTAINER
 #   EMBY_URL                  ← HOST*_EMBY_URL
 #   EMBY_API_KEY              ← HOST*_EMBY_API_KEY
+#   GITEA_API_TOKEN           ← HOST*_GITEA_API_TOKEN
 #
 # Arr-specific vars set by detect_hosts() when needed by arr scripts:
 #   LIDARR_URL / LIDARR_API_KEY / LIDARR_MUSIC_ROOT (MY_ID only — Lidarr is HOST1 only)
@@ -465,6 +466,9 @@ detect_hosts() {
     EMBY_API_KEY_VAR="${MY_ID}_EMBY_API_KEY"
     EMBY_API_KEY="${!EMBY_API_KEY_VAR:-}"
 
+    GITEA_API_TOKEN_VAR="${MY_ID}_GITEA_API_TOKEN"
+    GITEA_API_TOKEN="${!GITEA_API_TOKEN_VAR:-}"
+
     local _prov_var
     for _prov_var in \
         PARTNERSHIP_PROVISION_EMBY_ADMIN \