[003] Add Forgejo stack behind Caddy at git.waldson.com.br

Run a single-user, self-hosted git server on the droplet. New forgejo/ compose
stack on proxy_net: git-over-SSH is published on host 2222 (container sshd on 22)
so the host's admin sshd keeps port 22, while the web UI (3000) is unpublished
and reached only through the central Caddy, which gains a git.waldson.com.br
reverse-proxy block. SQLite backs the instance and all state - repos, database,
generated app.ini, SSH host keys - lives in the forgejo_data volume, so a
force-recreate preserves every user and repository.

The full configuration is injected via FORGEJO__ environment variables and
written into app.ini on startup: registration disabled, Forgejo Actions
disabled, and DOMAIN/SSH_DOMAIN/SSH_PORT set so clone URLs carry the right host
and port. INSTALL_LOCK skips the web installer, so the single admin is created
from the CLI; the security posture survives recreation instead of depending on
installer clicks. README documents the deploy, admin-creation, SSH-config, and
upgrade runbook.

README.md

@@ -20,6 +20,8 @@ Caddyfile      one site block per app; each reverse_proxies to a container
                reachable by name on proxy_net
 syncthing/     the Syncthing stack (own compose file); GUI behind Caddy,
                sync protocol published on 22000
+forgejo/       the Forgejo stack (own compose file); web UI behind Caddy,
+               git-over-SSH published on 2222
 ```
 
 ## Prerequisites
@@ -133,6 +135,92 @@ These steps are done once by the owner at `https://sync.waldson.com.br`:
    torque-data) with the droplet and accept them on the droplet, pointing each
    folder path under `/var/syncthing` so the data lands in the bind mount.
 
+## Forgejo stack
+
+A single-user Forgejo instance (the owner's self-hosted git server) at
+`git.waldson.com.br`. It lives in `forgejo/` and deploys to
+`/home/waldson/central-proxy/forgejo` on the droplet.
+
+Only git-over-SSH is published on the host (`2222/tcp`), so the host's admin
+sshd keeps port 22. The web UI (`3000`) is **not** published; it is reached only
+through Caddy at `git.waldson.com.br`. The central `Caddyfile` carries the
+`git.waldson.com.br` block. SQLite is the database, and the whole instance is
+configured from environment variables in `compose.yaml` (registration disabled,
+Forgejo Actions disabled, correct clone-URL host/port), so the security posture
+is reproduced on every recreate rather than depending on installer clicks.
+
+### Where data lives
+
+Everything - git repositories, the SQLite database (`/data/gitea/gitea.db`), the
+generated `app.ini`, and the container's SSH host keys - lives in the
+`forgejo_data` named Docker volume mounted at `/data`. That one volume is the
+entire instance, so `docker compose up -d --force-recreate` preserves all users
+and repositories. Never `docker volume rm forgejo_data`: it discards every repo
+and account. (Off-site backup of this volume is a separate slice: a nightly
+`forgejo dump` into a Syncthing-shared folder.)
+
+### Deploy
+
+From `forgejo/` on the droplet:
+
+```sh
+docker compose up -d
+```
+
+The container comes up as `forgejo-forgejo-1` on `proxy_net`, which is the name
+Caddy reverse-proxies to. Recreating it preserves users and repositories:
+
+```sh
+docker compose up -d --force-recreate
+```
+
+### First-run setup (interactive)
+
+The web installer is locked (`INSTALL_LOCK=true`), so the single admin account
+is created from the CLI once, after the container is first up:
+
+```sh
+docker exec -u git forgejo-forgejo-1 \
+  forgejo admin user create \
+  --admin --username <admin> --email <you@example.com> \
+  --random-password --must-change-password
+```
+
+Log in at `https://git.waldson.com.br`, change the password, and add your SSH
+public key under Settings -> SSH / GPG Keys. Registration is already disabled, so
+there is no sign-up path for anyone else.
+
+### Cloning over SSH (port 2222)
+
+Forgejo advertises `ssh://git@git.waldson.com.br:2222/<user>/<repo>.git`. To keep
+remotes short (`git@git.waldson.com.br:<user>/<repo>.git`) on a personal machine,
+add this to `~/.ssh/config`:
+
+```
+Host git.waldson.com.br
+    HostName git.waldson.com.br
+    Port 2222
+    User git
+    IdentityFile ~/.ssh/id_ed25519
+```
+
+With that entry, `git clone git@git.waldson.com.br:<user>/<repo>.git` works
+without spelling out the port. HTTPS clone/pull works through Caddy with no SSH
+setup at all: `git clone https://git.waldson.com.br/<user>/<repo>.git`.
+
+### Upgrade
+
+The image is pinned to a Forgejo major version (`codeberg.org/forgejo/forgejo:11`).
+Patch and minor updates within that major are safe:
+
+```sh
+docker compose pull && docker compose up -d
+```
+
+A major bump (editing the tag to the next number) runs one-way database
+migrations. Do it one major at a time, back up `forgejo_data` first, and read the
+Forgejo release notes before changing the tag.
+
 ## Droplet groundwork
 
 Baseline host configuration for the droplet (`wloud`, 174.138.36.232,