[003] Add Forgejo stack behind Caddy at git.waldson.com.br

Run a single-user, self-hosted git server on the droplet. New forgejo/ compose
stack on proxy_net: git-over-SSH is published on host 2222 (container sshd on 22)
so the host's admin sshd keeps port 22, while the web UI (3000) is unpublished
and reached only through the central Caddy, which gains a git.waldson.com.br
reverse-proxy block. SQLite backs the instance and all state - repos, database,
generated app.ini, SSH host keys - lives in the forgejo_data volume, so a
force-recreate preserves every user and repository.

The full configuration is injected via FORGEJO__ environment variables and
written into app.ini on startup: registration disabled, Forgejo Actions
disabled, and DOMAIN/SSH_DOMAIN/SSH_PORT set so clone URLs carry the right host
and port. INSTALL_LOCK skips the web installer, so the single admin is created
from the CLI; the security posture survives recreation instead of depending on
installer clicks. README documents the deploy, admin-creation, SSH-config, and
upgrade runbook.

Caddyfile

@@ -9,3 +9,7 @@ www.nazareonline.com.br, nazareonline.com.br {
 sync.waldson.com.br {
 	reverse_proxy syncthing-syncthing-1:8384
 }
+
+git.waldson.com.br {
+	reverse_proxy forgejo-forgejo-1:3000
+}