add Gitea Bot interface: webhook server, API tool, Caddy ingress

- Add src/gitea.rs: axum webhook server on :9800, handles @mention in
  issues and PRs, spawns claude -p for review, posts result as comment
- Add call_gitea_api tool: LLM can directly call Gitea REST API with
  pre-configured admin token (noc_bot identity)
- Add Caddy to Docker image as ingress layer (subdomain/path routing)
- Config: add gitea section with token_file support for auto-provisioned token
- Update suite.md: VPS-first deployment, SubAgent architecture, Caddy role

src/main.rs

@@ -1,9 +1,10 @@
 mod config;
-mod state;
-mod tools;
-mod stream;
 mod display;
+mod gitea;
 mod life;
+mod state;
+mod stream;
+mod tools;
 
 use std::collections::HashSet;
 use std::path::{Path, PathBuf};
@@ -71,8 +72,11 @@ async fn main() {
     let config_path = std::env::var("NOC_CONFIG").unwrap_or_else(|_| "config.yaml".into());
     let raw = std::fs::read_to_string(&config_path)
         .unwrap_or_else(|e| panic!("read {config_path}: {e}"));
-    let config: Config =
+    let mut config: Config =
         serde_yaml::from_str(&raw).unwrap_or_else(|e| panic!("parse config: {e}"));
+    if let Some(ref mut gitea) = config.gitea {
+        gitea.resolve_token();
+    }
 
     let state_path = std::env::var("NOC_STATE")
         .map(PathBuf::from)
@@ -93,6 +97,16 @@ async fn main() {
     // start life loop
     tokio::spawn(life::life_loop(bot.clone(), state.clone(), config.clone()));
 
+    // start gitea webhook server
+    if let Some(gitea_config) = &config.gitea {
+        let gc = gitea_config.clone();
+        // Use the gitea admin username as the bot user for @mention detection
+        let bot_user = std::env::var("GITEA_ADMIN_USER").unwrap_or_else(|_| "noc".into());
+        tokio::spawn(async move {
+            gitea::start_webhook_server(&gc, bot_user).await;
+        });
+    }
+
     Dispatcher::builder(bot, handler)
         .dependencies(dptree::deps![state, config, bot_username])
         .default_handler(|_| async {})