fix(infra): gitea SSH ports — rootless listens on 2222 (Phase 2B)

- gitea-sshd svc targetPort 22->2222 (rootless gitea binds non-privileged 2222)
- netpol ingress ssh port 22->2222 (NetworkPolicy ports are POD ports, not svc ports)
SSH over ssh://git@git.fxhnt.ai now works (port 22 via proxy socat -> 2222).

infra/k8s/gitea/clusterip-services.yaml

@@ -36,5 +36,5 @@ spec:
   ports:
     - name: ssh
       port: 22
-      targetPort: 22
+      targetPort: 2222   # rootless gitea listens on 2222 internally (can't bind privileged 22)
       protocol: TCP

infra/k8s/gitea/networkpolicy.yaml

@@ -22,7 +22,7 @@ spec:
                 values: ["foxhunt", "argo-workflows"]
       ports:
         - { port: 3000, protocol: TCP }
-        - { port: 22, protocol: TCP }
+        - { port: 2222, protocol: TCP }
     # web + ssh from the tailscale proxy (nginx + socat) that fronts git.fxhnt.ai
     - from:
         - podSelector:
@@ -30,7 +30,7 @@ spec:
               app.kubernetes.io/name: tailscale-gitlab-proxy
       ports:
         - { port: 3000, protocol: TCP }
-        - { port: 22, protocol: TCP }
+        - { port: 2222, protocol: TCP }
   egress:
     # PostgreSQL
     - to: