add Gitea Bot interface: webhook server, API tool, Caddy ingress

- Add src/gitea.rs: axum webhook server on :9800, handles @mention in
  issues and PRs, spawns claude -p for review, posts result as comment
- Add call_gitea_api tool: LLM can directly call Gitea REST API with
  pre-configured admin token (noc_bot identity)
- Add Caddy to Docker image as ingress layer (subdomain/path routing)
- Config: add gitea section with token_file support for auto-provisioned token
- Update suite.md: VPS-first deployment, SubAgent architecture, Caddy role

src/config.rs

@@ -11,6 +11,40 @@ pub struct Config {
     pub backend: BackendConfig,
     #[serde(default)]
     pub whisper_url: Option<String>,
+    #[serde(default)]
+    pub gitea: Option<GiteaConfig>,
+}
+
+#[derive(Deserialize, Clone)]
+pub struct GiteaConfig {
+    pub url: String,
+    /// Direct token or read from token_file at startup
+    #[serde(default)]
+    pub token: String,
+    #[serde(default)]
+    pub token_file: Option<String>,
+    #[serde(default = "default_webhook_port")]
+    pub webhook_port: u16,
+    #[serde(default)]
+    pub webhook_secret: Option<String>,
+}
+
+impl GiteaConfig {
+    /// Resolve token: if token_file is set and token is empty, read from file
+    pub fn resolve_token(&mut self) {
+        if self.token.is_empty() {
+            if let Some(path) = &self.token_file {
+                match std::fs::read_to_string(path) {
+                    Ok(t) => self.token = t.trim().to_string(),
+                    Err(e) => tracing::error!("failed to read gitea token_file {path}: {e}"),
+                }
+            }
+        }
+    }
+}
+
+fn default_webhook_port() -> u16 {
+    9800
 }
 
 fn default_name() -> String {