chore(gitea): add git.forust.xyz route

gitea/k8s/certificates.yaml

@@ -8,6 +8,7 @@ spec:
   dnsNames:
     - gcr.forust.xyz
     - gitea.forust.xyz
+    - git.forust.xyz
   issuerRef:
     name: letsencrypt-prod
     kind: ClusterIssuer

gitea/k8s/ingress.yaml

@@ -7,18 +7,11 @@ spec:
   entryPoints:
     - websecure
   routes:
-    - match: Host(`gitea.forust.xyz`)
+    - match: Host(`gitea.forust.xyz`) || Host(`git.forust.xyz`)
       kind: Rule
       services:
         - name: gitea-service
           port: 3000
-    # Registry route: NO crowdsec-bouncer.
-    # A deploy burst (runner Action API polls, `docker manifest inspect` per
-    # own image, containerd pulls, smoke probes) fires hundreds of parallel
-    # registry calls, and a ban on the runner breaks every later job. This
-    # route only serves authenticated OCI traffic - registry tokens and
-    # basic-auth are already handled by gitea - and scanners get nothing
-    # useful from /v2, so there is no bruteforce surface to protect here.
     - match: Host(`gcr.forust.xyz`) && PathPrefix(`/v2`)
       kind: Rule
       services:
@@ -36,7 +29,7 @@ spec:
   entryPoints:
     - websecure
   routes:
-    - match: Host(`gitea.workstation.internal`) || Host(`gitea.gigaforust.internal`)
+    - match: (Host(`gitea.workstation.internal`) || Host(`gitea.gigaforust.internal`)) || (Host(`git.workstation.internal`) || Host(`git.gigaforust.internal`))
       kind: Rule
       services:
         - name: gitea-service