feat(gitea): open public sign-up with issue/comments-only accounts

- Enable registration with image CAPTCHA for spam protection.
- Set USER/ORG_MAX_CREATION_LIMIT=0 so new users cannot create repos/orgs
  and thus cannot store code; issues/comments only.
- Keep DISABLE_MIGRATIONS and push-create off.
- Admin (petere) is exempted via per-user override in the admin panel.

modules/services/gitea.nix

@@ -12,7 +12,11 @@
 #
 # Hardening posture (public instance):
 #   - HTTPS only (DISABLE_SSH) so there is no second public port to forward.
-#   - Invite-only: registration disabled, everything hidden behind sign-in.
+#   - Open registration (with image CAPTCHA) for issue/comments-only accounts:
+#     users CANNOT create repos or orgs (USER/ORG_MAX_CREATION_LIMIT = 0) so no
+#     code can be stored. The admin (petere) is exempted via a per-user override
+#     in the admin panel.
+#   - Public repos are browsable anonymously; private content requires login.
 #   - The firewall admits ONLY the proxy's Tailscale IP; no other tailnet
 #     node (or the LAN) can reach Gitea directly.
 #   - X-Forwarded-* headers are trusted only from that proxy IP.
@@ -58,6 +62,12 @@
         interval = "daily";
         type = "tar.zst";
       };
+      # Image CAPTCHA on registration to deter bots spamming accounts. No
+      # external service keys needed for the `image` type.
+      captcha = {
+        enable = true;
+        type = "image";
+      };
       settings = {
         server = {
           DOMAIN = config.services.gitea-server.domain;
@@ -72,11 +82,14 @@
           COOKIE_SECURE = true;
         };
         service = {
-          DISABLE_REGISTRATION = true;
+          # Public sign-up enabled so anyone can report issues/comment. Accounts
+          # are issue/comments-only (see repository limits below): they cannot
+          # create repos or orgs, so no code can be stored.
+          DISABLE_REGISTRATION = false;
+          SHOW_REGISTRATION_BUTTON = true;
           # Allow anonymous browsing of public repos; private content still
           # requires login. (REQUIRE_SIGNIN_VIEW would hide even public repos.)
           REQUIRE_SIGNIN_VIEW = false;
-          SHOW_REGISTRATION_BUTTON = false;
         };
         security = {
           REVERSE_PROXY_TRUSTED_PROXIES = config.services.gitea-server.proxyIp;
@@ -91,6 +104,11 @@
         };
         repository = {
           DISABLE_MIGRATIONS = true;
+          # Regular users get zero repo/org creation quota -> issues/comments
+          # only. Admin (petere) is exempted via a per-user override in the
+          # admin panel (Site Administration -> Users).
+          USER_MAX_CREATION_LIMIT = 0;
+          ORG_MAX_CREATION_LIMIT = 0;
         };
         other = {
           SHOW_FOOTER_VERSION = false;