Add Gitea Actions deploy pipeline + deployer RBAC

- .gitea/workflows/deploy.yaml: PRs run a server-side dry-run; pushes to
  main apply the kustomization and wait for all rollouts. Modeled on
  socktop-webterm's pipeline; uses the same KUBECONFIG secret convention
  and gitea-deployer ServiceAccount.
- rbac/gitea-deployer.yaml: ClusterRole/Binding (admin bootstrap, outside
  the root kustomization) — repo resource kinds only, no secrets access,
  no delete verbs, no RBAC escalation. Applied to the cluster 2026-07-26.
- One-time env->secretKeyRef migration executed against the cluster;
  README updated.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

.gitea/workflows/deploy.yaml

@@ -0,0 +1,95 @@
+name: Validate and Deploy to K3s
+
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+    branches:
+      - main
+
+jobs:
+  validate:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Install kubectl
+        run: |
+          if ! command -v kubectl &> /dev/null; then
+            ARCH=$(uname -m)
+            if [ "$ARCH" = "aarch64" ]; then
+              ARCH="arm64"
+            elif [ "$ARCH" = "x86_64" ]; then
+              ARCH="amd64"
+            fi
+            curl -LO "https://dl.k8s.io/release/$(curl -L -s https://dl.k8s.io/release/stable.txt)/bin/linux/${ARCH}/kubectl"
+            chmod +x kubectl
+            sudo mv kubectl /usr/local/bin/
+          fi
+          kubectl version --client
+
+      - name: Configure kubectl
+        run: |
+          mkdir -p $HOME/.kube
+          echo "${{ secrets.KUBECONFIG }}" | base64 -d > $HOME/.kube/config
+          chmod 600 $HOME/.kube/config
+
+      - name: Server-side dry-run of full kustomization
+        run: |
+          kubectl apply -k . --dry-run=server
+
+  deploy:
+    needs: validate
+    runs-on: ubuntu-latest
+    if: github.event_name != 'pull_request'
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Install kubectl
+        run: |
+          if ! command -v kubectl &> /dev/null; then
+            ARCH=$(uname -m)
+            if [ "$ARCH" = "aarch64" ]; then
+              ARCH="arm64"
+            elif [ "$ARCH" = "x86_64" ]; then
+              ARCH="amd64"
+            fi
+            curl -LO "https://dl.k8s.io/release/$(curl -L -s https://dl.k8s.io/release/stable.txt)/bin/linux/${ARCH}/kubectl"
+            chmod +x kubectl
+            sudo mv kubectl /usr/local/bin/
+          fi
+          kubectl version --client
+
+      - name: Configure kubectl
+        run: |
+          mkdir -p $HOME/.kube
+          echo "${{ secrets.KUBECONFIG }}" | base64 -d > $HOME/.kube/config
+          chmod 600 $HOME/.kube/config
+
+      - name: Apply kustomization
+        run: |
+          kubectl apply -k .
+
+      - name: Wait for rollouts
+        run: |
+          set -e
+          kubectl rollout status deploy/bitwarden-vaultwarden -n bitwarden --timeout=10m
+          kubectl rollout status deploy/searxng-1723974683 -n default --timeout=10m
+          kubectl rollout status deploy/home-assistant -n home-assistant --timeout=15m
+          kubectl rollout status deploy/nginx -n nginx --timeout=10m
+          kubectl rollout status deploy/pihole -n pihole --timeout=10m
+          kubectl rollout status deploy/unbound -n pihole --timeout=10m
+          kubectl rollout status deploy/unifiedstreaming -n unified-streaming --timeout=10m
+
+      - name: Deployment summary
+        if: always()
+        run: |
+          echo "## Deployment Summary" >> $GITHUB_STEP_SUMMARY
+          echo '```' >> $GITHUB_STEP_SUMMARY
+          for ns in bitwarden default home-assistant nginx pihole unified-streaming; do
+            kubectl get deployments -n $ns >> $GITHUB_STEP_SUMMARY || true
+          done
+          echo '```' >> $GITHUB_STEP_SUMMARY