feat(devtools): migrate Gitea to OpenBao DB static role; sync admin creds via VSO

- gitea-db-credentials is now a VaultDynamicSecret reading from
  database/static-creds/gitea (OpenBao static role, 24h password rotation).
  Replaces the previous KV-based Secret that used a hardcoded localdev password.
- gitea-admin-credentials and gitea-s3-credentials remain VaultStaticSecrets
  synced from secret/gitea and secret/seaweedfs respectively.
- gitea-values.yaml adds gitea.admin.existingSecret so the chart reads the
  admin username/password from the VSO-managed Secret instead of values.

base/devtools/kustomization.yaml

@@ -5,6 +5,7 @@ namespace: devtools
 
 resources:
   - namespace.yaml
+  - vault-secrets.yaml
 
 helmCharts:
   # helm repo add gitea-charts https://dl.gitea.com/charts/