docs(us2): gitea-health runbook + 收口 Gitea 文档漂移 (Plane VPS-94)

- runbooks/gitea-health.md 新建: 只读健康检查(容器/版本pin/web/SSH/备份/内存闸门)+ AGENTS 与索引登记
- AGENTS.md: Gitea upstream 段(digest 升级流程/app.ini 600 含密钥)、SSH 示例改 git@、runbook 表加行
- inventory/hosts.md + hosts/us2: repo.windy.me SSH 用户改 git@; us2 角色行 Gitea 化
- hosts/us2: 仓库数修正 16→17(windy/13 含 vps、go-caatsm + cdia/4); Verified 补 2026-09-19 独立审核结果
- 本仓库 remote 已改写为 ssh://git@repo.windy.me:2222/windy/vps.git(VPS-94 Phase 3 漏项)

hosts/us2.wsvc.info.md

@@ -2,7 +2,7 @@
 
 | Item | Value |
 |------|--------|
-| Role | Multi-service VPS (Vaultwarden, Traefik, Soft Serve, …) |
+| Role | Multi-service VPS (Vaultwarden, Traefik, Gitea, …) |
 | SSH | `ssh -4 windy@us2.wsvc.info` (prefer IPv4 from WSL) |
 | IPv4 | `193.9.44.165` |
 | Also DNS | `auth.wsvc.info` → this host; `repo.windy.me` → this host (Gitea) |
@@ -90,7 +90,7 @@ ansible-playbook playbooks/compose-reconcile.yml --limit vaultwarden \
 - SSH: 内置 server 容器内 `:2322`(`SSH_LISTEN_PORT` 非特权), Traefik TCP entrypoint `ssh`(`:2222` → `gitea:2322`, `HostSNI(*)`, `tls=false`) on `vw-net`; clone URL `ssh://git@repo.windy.me:2222/windy/<repo>.git`(owner 段 `windy`)
 - **host key 复用 soft-serve**(`SSH_SERVER_HOST_KEYS=/secrets/soft_serve_host_ed25519`, ed25519, 指纹 `SHA256:PdxZRe74…`): 客户端 known_hosts 零变更; 仅公钥认证(密码认证未启用)
 - Web: `https://repo.windy.me`(Traefik websecure + letsencrypt); `DISABLE_REGISTRATION=true`, Actions 关闭; 管理员 `windy`(凭据仅存服务器 `/opt/gitea/.admin-credentials`, 勿入库/入 Plane)
-- 仓库: 16 个(顶层 11 + `cdia/` 4 + `windyboy/go-caatsm`), 2026-09-18 自 soft-serve `push --mirror` 迁移, 逐仓 `ls-remote` ref 全集 + HEAD symref 两端一致; 可见性仅 `dotfiles-personal` private, 其余 public(与 soft-serve 现状一致)
+- 仓库: 17 个(`windy/` 13 — 含 vps、自 `windyboy` 并入的 go-caatsm — + `cdia/` 4; 2026-09-19 复核), 2026-09-18 自 soft-serve `push --mirror` 迁移, 逐仓 `ls-remote` ref 全集 + HEAD symref 两端一致; 可见性仅 `dotfiles-personal` private, 其余 public(与 soft-serve 现状一致)
 - 备份: sidecar 每日 02:00 → `backups/gitea_<TS>/{app.ini.tar.gz, gitea.db, repos.tar.gz}`(app.ini 含恢复必需 SECRET_KEY), 03:00 prune 保留 14 份; 已验证手动备份产物 109.9M
 - 回滚: `/opt/soft-serve` 未删(compose stop + sidecar 停, 数据与旧备份冻结保留), 回滚 = Traefik `:2222` 指回 `soft-serve:23231` + 客户端 remote 回改旧无 owner 段路径; 观察 2–4 周后清理(历史: W1N-244~248)
 | `traefik` | Up | `traefik:v3.6.2` (`/opt/traefik`, public `:80`/`:443`) |
@@ -102,7 +102,7 @@ Remaining running services on this host: `gitea`, `vaultwarden` stack, `traefik`
 
 ## Verified
 
-Last checked: **2026-09-18** — operational; disk cleanup done (see note above, Plane vps VPS-93). Prior full probe: 2026-08-29.
+Last checked: **2026-09-19** — operational. Gitea independently audited (read-only): `1.27.3` = latest 1.27.x patch; HTTPS 200 (LE cert → 2026-12-17); SSH `git@…:2222` key auth OK; backup 02:00 OK (110M); memory available 584 MB; logs clean (record: Plane VPS-94 comment 2026-09-19). Prior: 2026-09-18 migration + disk cleanup (VPS-93); 2026-08-29 full Vaultwarden probe.
 
 - `vaultwarden` + `vw-db` healthy; `DATABASE_URL` → `pg:5432/vaultwarden`
 - `https://auth.wsvc.info/` **200**, `/admin` **200**, `/api/config` OK (`disableUserRegistration: true`)