Add Gitea Actions runner (Docker executor)

- Enable Gitea Actions in the container (GITEA__actions__ENABLED)
- Run dockerd alongside podman for job containers
- services.gitea-actions-runner: instance-wide runner "fileserver",
  Docker labels, registered against the internal LAN URL; reads the
  registration token from /data/secrets/gitea-runner-token

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

modules/fileserver.nix

@@ -193,6 +193,34 @@
       GITEA__server__SSH_PORT = "2222";
       GITEA__server__SSH_LISTEN_PORT = "2222";
       GITEA__server__START_SSH_SERVER = "true";
+      # Actions (CI) aktivieren — Voraussetzung für den act_runner unten.
+      GITEA__actions__ENABLED = "true";
+    };
+  };
+
+  ########################################
+  # Gitea Actions Runner
+  ########################################
+  # Docker-Daemon für die Job-Container des Runners (läuft parallel zu Podman,
+  # das weiterhin die App-Container betreibt).
+  virtualisation.docker.enable = true;
+
+  services.gitea-actions-runner = {
+    package = pkgs.gitea-actions-runner;
+    instances.fileserver = {
+      enable = true;
+      name = "fileserver";
+      # Interne LAN-URL — vom Host UND aus den Docker-Job-Containern erreichbar
+      # (localhost/127.0.0.1 würde im Job-Container auf den Container selbst zeigen).
+      url = "http://10.202.82.6:3000";
+      # Registration-Token: in Gitea unter Site Admin → Actions → Runners →
+      # "Create new Runner" erzeugen und in diese Datei schreiben (0600 root).
+      tokenFile = "/data/secrets/gitea-runner-token";
+      labels = [
+        "ubuntu-latest:docker://node:20-bookworm"
+        "ubuntu-22.04:docker://node:20-bookworm"
+        "alpine:docker://alpine:3.19"
+      ];
     };
   };