feat(infra): cut git.fxhnt.ai over to Gitea via tailnet proxy (Phase 2B)

- gitea-web/gitea-sshd ClusterIP services: the chart's gitea-http/ssh are HEADLESS
  (pod IP 100.64.x) which COLLIDES with the Tailscale CGNAT range 100.64.0.0/10, so the
  tailscale-sidecar proxy swallowed the traffic. ClusterIP (10.32.x) fixes it.
- tailscale-proxy: nginx git.fxhnt.ai -> gitea-web:3000; socat :22 -> gitea-sshd:22
  (drop :2222, GitLab); GitLab webservice/registry blocks left for Task 4/2C.
- dns git_ip -> 100.95.225.27 (live proxy node); stale 100.90.76.85 duplicate A records
  removed across api/chat/dashboard/git/grafana/mail/minio (were causing platform-wide flakiness).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

infra/k8s/gitea/clusterip-services.yaml

@@ -0,0 +1,40 @@
+# The gitea chart's gitea-http/gitea-ssh services are HEADLESS (clusterIP: None), so they resolve to the
+# pod IP (100.64.x.x). That range OVERLAPS the Tailscale CGNAT range (100.64.0.0/10), so the tailscale
+# sidecar in the tailscale-gitlab-proxy pod swallows traffic to the pod IP. These normal ClusterIP services
+# give Gitea a service IP in the service CIDR (10.32.x.x, outside the tailscale range) — the proxy nginx +
+# socat target these instead. (GitLab worked because its webservice svc was a normal ClusterIP.)
+apiVersion: v1
+kind: Service
+metadata:
+  name: gitea-web
+  namespace: foxhunt
+  labels:
+    app.kubernetes.io/name: gitea
+spec:
+  type: ClusterIP
+  selector:
+    app.kubernetes.io/name: gitea
+    app.kubernetes.io/instance: gitea
+  ports:
+    - name: http
+      port: 3000
+      targetPort: 3000
+      protocol: TCP
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: gitea-sshd
+  namespace: foxhunt
+  labels:
+    app.kubernetes.io/name: gitea
+spec:
+  type: ClusterIP
+  selector:
+    app.kubernetes.io/name: gitea
+    app.kubernetes.io/instance: gitea
+  ports:
+    - name: ssh
+      port: 22
+      targetPort: 22
+      protocol: TCP

infra/k8s/gitlab/tailscale-proxy.yaml

@@ -75,10 +75,10 @@ spec:
         - name: ssh-proxy
           image: alpine/socat:latest
           args:
-            - "TCP-LISTEN:2222,fork,reuseaddr,sndbuf=1048576,rcvbuf=1048576"
-            - "TCP:gitlab-gitlab-shell.foxhunt.svc.cluster.local:2222,sndbuf=1048576,rcvbuf=1048576"
+            - "TCP-LISTEN:22,fork,reuseaddr,sndbuf=1048576,rcvbuf=1048576"
+            - "TCP:gitea-sshd.foxhunt.svc.cluster.local:22,sndbuf=1048576,rcvbuf=1048576"
           ports:
-            - containerPort: 2222
+            - containerPort: 22
           resources:
             requests:
               cpu: 25m
@@ -152,7 +152,7 @@ data:
         return 301 https://$host$request_uri;
     }
 
-    # GitLab — git.fxhnt.ai
+    # Gitea — git.fxhnt.ai (replaced GitLab, Phase 2B cutover)
     server {
         listen 443 ssl;
         server_name git.fxhnt.ai;
@@ -164,7 +164,7 @@ data:
         client_max_body_size 0;
 
         location / {
-            proxy_pass http://gitlab-webservice-default.foxhunt.svc.cluster.local:8181;
+            proxy_pass http://gitea-web.foxhunt.svc.cluster.local:3000;
             proxy_set_header Host $http_host;
             proxy_set_header X-Real-IP $remote_addr;
             proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

infra/live/production/dns/terragrunt.hcl

@@ -8,6 +8,7 @@ terraform {
 
 inputs = {
   dns_zone  = "fxhnt.ai"
-  # Tailscale IP of foxhunt-gitlab proxy pod
-  git_ip = "100.90.76.85"
+  # Tailscale IP of the foxhunt-gitlab proxy pod (live node foxhunt-gitlab; the old 100.90.76.85
+  # was a stale prior IP — its duplicate A records across *.fxhnt.ai were removed 2026-06-21).
+  git_ip = "100.95.225.27"
 }