feat(devtools): migrate Gitea to OpenBao DB static role; sync admin creds via VSO

- gitea-db-credentials is now a VaultDynamicSecret reading from
  database/static-creds/gitea (OpenBao static role, 24h password rotation).
  Replaces the previous KV-based Secret that used a hardcoded localdev password.
- gitea-admin-credentials and gitea-s3-credentials remain VaultStaticSecrets
  synced from secret/gitea and secret/seaweedfs respectively.
- gitea-values.yaml adds gitea.admin.existingSecret so the chart reads the
  admin username/password from the VSO-managed Secret instead of values.

base/devtools/gitea-values.yaml

@@ -13,6 +13,11 @@ valkey:
   enabled: false
 
 gitea:
+  admin:
+    username: gitea_admin
+    existingSecret: gitea-admin-credentials
+    email: gitea@local.domain
+
   config:
     server:
       DOMAIN:           src.DOMAIN_SUFFIX