Fixes discovered during live provisioning: app.ini permissions
(root:gitea + 660→640 for token generation), HTTPS via acme.sh
DNS-01, setcap for port 443, admin user creation, INSTALL_LOCK
lifecycle. Secrets replaced with placeholders.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
