deploy: private package pull via External Secrets; pull over public HTTPS (no k3s restart)

- k3s pulls git.7tl-homelab.com/... over valid TLS (no registries.yaml/node config)
- CI still pushes internally to 10.66.15.22:3000 (fast, insecure-trusted)
- ExternalSecret materializes gitea-registry dockerconfigjson from OpenBao
- deployment uses imagePullSecrets: gitea-registry
- .env added to .dockerignore

.gitea/workflows/ci.yml

@@ -27,7 +27,11 @@ on:
       - '**/*.md'
 
 env:
-  IMAGE: 10.66.15.22:3000/bmr_bluecap/bcs-website
+  # Push over the internal HTTP endpoint (fast, no edge; host dockerd trusts it as insecure).
+  PUSH_IMAGE: 10.66.15.22:3000/bmr_bluecap/bcs-website
+  # k3s pulls over the public HTTPS endpoint (valid TLS -> no registries.yaml / node config / restart).
+  # Same Gitea package as PUSH_IMAGE, just a different access path.
+  DEPLOY_IMAGE: git.7tl-homelab.com/bmr_bluecap/bcs-website
 
 jobs:
   ci:
@@ -70,7 +74,7 @@ jobs:
       - name: Build & push image to Gitea Packages
         run: |
           echo "${{ secrets.CI_TOKEN }}" | docker login 10.66.15.22:3000 -u "${{ github.repository_owner }}" --password-stdin
-          docker build -t "$IMAGE:${{ steps.tag.outputs.sha }}" -t "$IMAGE:latest" .
+          docker build -t "$PUSH_IMAGE:${{ steps.tag.outputs.sha }}" -t "$PUSH_IMAGE:latest" .
           # Registry pushes can time out on a slow blob; docker push is resumable, so retry.
           push_retry() {
             for i in 1 2 3 4 5; do
@@ -80,14 +84,15 @@ jobs:
             done
             return 1
           }
-          push_retry "$IMAGE:${{ steps.tag.outputs.sha }}"
-          push_retry "$IMAGE:latest"
+          push_retry "$PUSH_IMAGE:${{ steps.tag.outputs.sha }}"
+          push_retry "$PUSH_IMAGE:latest"
 
       - name: Bump k8s image tag and commit back
         run: |
           git config user.name "gitea-actions[bot]"
           git config user.email "gitea-actions@bmr_bluecap"
-          (cd k8s && kustomize edit set image "$IMAGE=$IMAGE:${{ steps.tag.outputs.sha }}")
+          # Deployment references the public HTTPS image (what k3s pulls); bump its tag.
+          (cd k8s && kustomize edit set image "$DEPLOY_IMAGE=$DEPLOY_IMAGE:${{ steps.tag.outputs.sha }}")
           git add k8s/kustomization.yaml
           git diff --cached --quiet && { echo "no image change"; exit 0; }
           git commit -m "ci: deploy ${{ steps.tag.outputs.sha }} [skip ci]"