add Gitea Bot interface: webhook server, API tool, Caddy ingress

- Add src/gitea.rs: axum webhook server on :9800, handles @mention in
  issues and PRs, spawns claude -p for review, posts result as comment
- Add call_gitea_api tool: LLM can directly call Gitea REST API with
  pre-configured admin token (noc_bot identity)
- Add Caddy to Docker image as ingress layer (subdomain/path routing)
- Config: add gitea section with token_file support for auto-provisioned token
- Update suite.md: VPS-first deployment, SubAgent architecture, Caddy role

deploy/Dockerfile

@@ -10,17 +10,24 @@ RUN curl -fSL "https://dl.gitea.com/gitea/${GITEA_VERSION}/gitea-${GITEA_VERSION
         -o /usr/local/bin/gitea \
     && chmod +x /usr/local/bin/gitea
 
+# install caddy
+ARG CADDY_VERSION=2.9.1
+RUN curl -fSL "https://github.com/caddyserver/caddy/releases/download/v${CADDY_VERSION}/caddy_${CADDY_VERSION}_linux_amd64.tar.gz" \
+        | tar -xz -C /usr/local/bin caddy \
+    && chmod +x /usr/local/bin/caddy
+
 # noc binary (pre-built musl static binary)
 COPY noc /usr/local/bin/noc
 RUN chmod +x /usr/local/bin/noc
 
 COPY tools/ /opt/noc/tools/
 COPY config.example.yaml /opt/noc/config.example.yaml
+COPY Caddyfile /opt/noc/Caddyfile
 COPY entrypoint.sh /entrypoint.sh
 RUN chmod +x /entrypoint.sh
 
 RUN useradd -m -s /bin/bash noc \
-    && mkdir -p /data/gitea /data/noc \
+    && mkdir -p /data/gitea /data/noc /data/caddy /data/www \
     && chown -R noc:noc /data /opt/noc
 VOLUME ["/data"]
 USER noc
@@ -28,8 +35,9 @@ USER noc
 ENV RUST_LOG=noc=info \
     NOC_CONFIG=/data/noc/config.yaml \
     NOC_STATE=/data/noc/state.json \
-    GITEA_WORK_DIR=/data/gitea
+    GITEA_WORK_DIR=/data/gitea \
+    XDG_DATA_HOME=/data/caddy
 
-EXPOSE 3000
+EXPOSE 80 443
 
 ENTRYPOINT ["/entrypoint.sh"]