chore: seed gitea-repo-template cookie-cutter

Reusable repo template for homelab services on git.aridgwayweb.com.

Bakes in (all verified live on armistace/wedding-photos):
- Hard commit guard: shared pre-commit hook (git config core.hooksPath
  ~/dev/git-hooks) + master branch protection (push whitelist [armistace],
  merge whitelist [hermes, armistace]).
- Gitea Actions CI (.gitea/workflows/build_push.yml): test + build-deploy,
  persistent remote buildkit cache, registry push, idempotent deploy that
  preserves hand-provisioned Secrets, cluster injection from repo secrets/vars
  via scripts/reconcile-cluster-inject.sh.
- Persistent buildkit cache (ci/buildkit/): single-replica Longhorn backing.
- scripts/reconcile-cluster-inject.sh: reconcile live Secret/ConfigMap from
  Gitea secrets/vars without clobbering hand-provisioned values.
- RUNBOOK.md: handoff-complete ops doc.

Placeholders (<APP> <OWNER> <NS> <KEY_*>) are filled per-service on repo creation.

kube/APP-backend_deploy.yaml

@@ -0,0 +1,25 @@
+# Template placeholder deployment. Convention: <APP>-backend_deploy.yaml
+# CRITICAL: every pod spec must reference the regcred imagePullSecret or pods
+# hit ImagePullBackOff pulling from the private registry.
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: <APP>-backend
+  namespace: <NS>
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: <APP>-backend
+  template:
+    metadata:
+      labels:
+        app: <APP>-backend
+    spec:
+      imagePullSecrets:
+        - name: regcred
+      containers:
+        - name: backend
+          image: git.aridgwayweb.com/<OWNER>/<APP>:latest
+          ports:
+            - containerPort: 8000

kube/APP-backend_service.yaml

@@ -0,0 +1,12 @@
+# Template placeholder service. Convention: <APP>-backend_service.yaml
+apiVersion: v1
+kind: Service
+metadata:
+  name: <APP>-backend
+  namespace: <NS>
+spec:
+  selector:
+    app: <APP>-backend
+  ports:
+    - port: 8000
+      targetPort: 8000

kube/NS_configmap.yaml

@@ -0,0 +1,9 @@
+# Template placeholder ConfigMap. Add keys matching reconcile-cluster-inject.sh
+# CM_KEYS entries. Convention: <NS>_configmap.yaml
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: <NS>-config
+  namespace: <NS>
+data:
+  <CONFIG_KEY_1>: ""

kube/NS_namespace.yaml

@@ -0,0 +1,6 @@
+# Template placeholder file — replace with your app's namespace manifest.
+# Convention: <NS>_namespace.yaml (matches the workflow's apply step).
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: <NS>