Add Gitea SSH setup script and integrate Gitea into partnership/failover

Partnership/gitea_ssh_setup.sh: generates ed25519 keypair, registers public key
  with Gitea API (POST /api/v1/user/keys), tests SSH connection, writes ~/.ssh/config
  entry. Idempotent — skips steps already done. --force regenerates and re-registers.
  Resolves Gitea endpoint from container IP first, falls back to GITEA_DOMAIN.

common.sh: alias HOST*_GITEA_API_TOKEN → GITEA_API_TOKEN in detect_hosts().
  Add to detect_hosts() doc comment.

master.conf: add GITEA_HTTP_PORT=3000 for API endpoint construction.

host1.conf: add HOST1_GITEA_API_TOKEN (fill in from Gitea Settings → Applications).
  Add my-Gitea.xml to HOST1_PARTNERSHIP_AUTH_STACK — onboard pushes it to HOST2.

host2.conf: add Gitea to FALLBACK_HOST2_COVERS_HOST1_TIER1 — starts immediately
  when HOST1 goes down, making the source of truth reachable independently of
  HOST1's auth stack.

host1.conf

@@ -87,6 +87,12 @@
     HOST1_EMBY_URL="http://localhost:8096"
     HOST1_EMBY_API_KEY="0c27448d93a7431f9ac63569f7655829"
 
+# ━━━ Gitea ━━━
+# Personal access token for gitea_ssh_setup.sh — registers this server's SSH public key
+# with Gitea so git operations use key auth instead of passwords.
+# Create in Gitea: Settings → Applications → Generate Token → scope: write:user
+    HOST1_GITEA_API_TOKEN=""
+
 # ━━━ Notifications ━━━
 # Discord webhook — leave blank to disable.
 # Per-host so HOST1 and HOST2 can post to different channels or only one server notifies.
@@ -121,6 +127,8 @@
         "my-Authelia-Secondary.xml"
         "my-NginxProxyManager.xml"
         "my-Lldap-Gmer4Lfe.xml"
+        # Source of truth — must be available on HOST2 independently of the auth stack
+        "my-Gitea.xml"
     )
 
 # XML templates pushed to mirror for the arr stack during onboard.