feat(infra): data, storage, devtools, and ory layer updates

- data: CNPG cluster tuning, OpenBao values, OpenSearch deployment fixes,
  OpenSearch PVC, barman vault secret for S3 backup credentials
- storage: SeaweedFS filer updates (s3.json via secret subPath), PVC for
  filer persistent storage
- devtools: Gitea values (SSH service, custom theme), gitea-theme-cm ConfigMap
- ory: add kratos-selfservice-urls.yaml for self-service flow URLs
- media: LiveKit values updated (TURN config, STUN, resource limits)
- vso: kustomization cleanup

base/devtools/gitea-values.yaml

@@ -19,11 +19,21 @@ gitea:
     email: gitea@local.domain
 
   config:
+    ui:
+      DEFAULT_THEME: sunbeam
+      THEMES: sunbeam
+
     server:
       DOMAIN:           src.DOMAIN_SUFFIX
       ROOT_URL:         https://src.DOMAIN_SUFFIX/
       SSH_DOMAIN:       src.DOMAIN_SUFFIX
-      LFS_START_SERVER: "true"
+      # Gitea advertises port 22 (users clone with git@src.DOMAIN_SUFFIX:org/repo.git).
+      # The pod listens on 2222; Pingora forwards external port 22 → pod port 2222.
+      SSH_PORT:              "22"
+      SSH_LISTEN_PORT:       "2222"
+      SSH_EXPOSE_ANONYMOUS:  "false"
+      LFS_START_SERVER:      "true"
+      LANDING_PAGE:     /studio
 
     database:
       DB_TYPE:  postgres
@@ -46,6 +56,12 @@ gitea:
       TYPE:     redis
       CONN_STR: redis://valkey.data.svc.cluster.local:6379/2?pool_size=100&idle_timeout=180s
 
+    oauth2_client:
+      # Auto-redirect to Hydra OIDC on login — makes OIDC the primary auth method.
+      OAUTH2_AUTO_REDIRECT_TO_PROVIDER: Sunbeam
+      # Register new OIDC users automatically.
+      ENABLE_AUTO_REGISTRATION: "true"
+
     storage:
       STORAGE_TYPE:   minio
       MINIO_ENDPOINT: seaweedfs-filer.storage.svc.cluster.local:8333
@@ -70,6 +86,33 @@ gitea:
           name: gitea-s3-credentials
           key: secret-key
 
+initPreScript: |
+  mkdir -p /data/gitea/public/assets/css
+  mkdir -p /data/gitea/public/assets/img
+
+extraVolumes:
+  - name: custom-theme
+    configMap:
+      name: gitea-custom-theme
+  - name: mkcert-ca
+    configMap:
+      name: gitea-mkcert-ca
+      optional: true   # only exists in local env; production omits it safely
+
+extraContainerVolumeMounts:
+  - name: custom-theme
+    mountPath: /data/gitea/public/assets/css/theme-sunbeam.css
+    subPath: theme-sunbeam.css
+    readOnly: true
+  - name: custom-theme
+    mountPath: /data/gitea/public/assets/img/logo.svg
+    subPath: logo.svg
+    readOnly: true
+  - name: mkcert-ca
+    mountPath: /run/ca/ca.crt
+    subPath: ca.crt
+    readOnly: true
+
 resources:
   limits:
     memory: 256Mi
@@ -77,6 +120,11 @@ resources:
     memory: 128Mi
     cpu: 100m
 
+service:
+  ssh:
+    # Pod listens on 2222 (SSH_LISTEN_PORT); Pingora proxies external port 22 → here.
+    port: 2222
+
 persistence:
   enabled: true
   size: 5Gi