docs(us2): gitea-health runbook + 收口 Gitea 文档漂移 (Plane VPS-94)

- runbooks/gitea-health.md 新建: 只读健康检查(容器/版本pin/web/SSH/备份/内存闸门)+ AGENTS 与索引登记
- AGENTS.md: Gitea upstream 段(digest 升级流程/app.ini 600 含密钥)、SSH 示例改 git@、runbook 表加行
- inventory/hosts.md + hosts/us2: repo.windy.me SSH 用户改 git@; us2 角色行 Gitea 化
- hosts/us2: 仓库数修正 16→17(windy/13 含 vps、go-caatsm + cdia/4); Verified 补 2026-09-19 独立审核结果
- 本仓库 remote 已改写为 ssh://git@repo.windy.me:2222/windy/vps.git(VPS-94 Phase 3 漏项)

AGENTS.md

@@ -23,7 +23,7 @@ This repo is the **agent ops handbook + fact source** for maintaining personal V
    > so plain `ssh` aborts with `Bad owner or permissions on ...`. Always use
    > `ssh -F /dev/null` from the agent shell and pass options explicitly
    > (`~/.ssh/config` is skipped; e.g. `ssh -F /dev/null -p 2222
-   > -i ~/.ssh/id_ed25519 windy@repo.windy.me`). `sudo` never works in the
+   > -i ~/.ssh/id_ed25519 git@repo.windy.me`). `sudo` never works in the
    > sandbox (`NoNewPrivs`, no capabilities, `/` read-only). The host itself is
    > healthy — to inspect or act on the real host from the sandbox use
    > `/mnt/c/WINDOWS/system32/wsl.exe -u root -- <cmd>` (real root: keep
@@ -85,6 +85,8 @@ not maintain a second copy of the machine table here.
 
 **RustDesk:** Self-hosted RustDesk server on `hk2.chans.xyz` (`/opt/rustdesk`, containers `hbbs`/`hbbr`, image pinned `1.1.14`). The `hbbs -r` relay hostname must resolve to the host's public IP `154.36.174.161` — use `hk2.chans.xyz` (never `hk2.wsvc.info`, which has no DNS record). Health: [rustdesk-health](runbooks/rustdesk-health.md).
 
+**Gitea (on us2):** Self-hosted Gitea at `repo.windy.me` (web HTTPS + git SSH `:2222`; clone `ssh://git@repo.windy.me:2222/windy/<repo>.git` — user must be `git@`, path needs the owner segment). Replaced Soft Serve 2026-09-18 (Plane VPS-94; `/opt/soft-serve` kept stopped as rollback). Before changing `/opt/gitea`, read [hosts/us2.wsvc.info.md](hosts/us2.wsvc.info.md). Image digest-pinned (`1.27.3-rootless`); upgrade = new digest in `compose.yml` + `docker compose up -d` + re-run health. `config/app.ini` is mode 600 and holds SECRET_KEY/INTERNAL_TOKEN — never commit; the backup sidecar includes it because restores need it. Health: [gitea-health](runbooks/gitea-health.md).
+
 ## Runbooks & scripts
 
 | Task | Path |
@@ -100,6 +102,7 @@ not maintain a second copy of the machine table here.
 | Matrix health | [runbooks/matrix-health.md](runbooks/matrix-health.md) |
 | Plane health | [runbooks/plane-health.md](runbooks/plane-health.md) |
 | RustDesk health (hk2) | [runbooks/rustdesk-health.md](runbooks/rustdesk-health.md) |
+| Gitea health (us2) | [runbooks/gitea-health.md](runbooks/gitea-health.md) |
 | AdGuard Home health | [runbooks/adguard-home-health.md](runbooks/adguard-home-health.md) |
 | Host disk cleanup | [runbooks/host-disk-cleanup.md](runbooks/host-disk-cleanup.md) |
 | Home Assistant maintenance | [runbooks/home-assistant-maintenance.md](runbooks/home-assistant-maintenance.md) + [scripts/ha-maintenance.sh](runbooks/scripts/ha-maintenance.sh) |