feat(phase 2.d gitea): read-only issue ingest on items with gitea-repo links

gitea package (new): minimal client mirroring caldav's structure
- client.go: token auth, 5s timeout, ErrNotFound
- issues.go: ListIssues(owner, repo, opts) hitting
  /repos/{o}/{r}/issues?type=issues&state=…&since=…, ParseRepoRef,
  RepoHTMLURL. PullRequest-flagged rows dropped server- and client-side.
- httptest stubs covering parse, 404, ParseRepoRef variants.

web wiring:
- Server.Gitea optional GiteaDeps (Client + in-memory 3-min TTL cache
  keyed by owner/repo|state).
- detailIssues iterates every gitea-repo link, sums open issues, captures
  last-30d closed (≤20) into a disclosure. Per-repo failures surface as
  banner; one missing repo never blanks the section.
- relativeTime renders "Nm/h/d ago" / "yesterday" / fallback date.

Templates:
- issues_section.tmpl: per-repo block, header "Issues (n) + ↗ Gitea repo",
  rows with #N · title · labels · milestone · assignees · updated.
  Titles open in new tab.
- detail.tmpl: include the partial when Gitea is on and issues != nil.
- CSS: matches the Tasks section visual language.

main.go: GITEA_URL gates the integration (off when unset). GITEA_URL set
but GITEA_TOKEN missing → refuse to start.

deploy/dokploy.yaml: GITEA_URL env + GITEA_TOKEN secret added.

docs/design.md: new §6 mirroring §5's structure (link model, listing
semantics, caching, env contract, parked items).

deploy/dokploy.yaml

@@ -39,8 +39,10 @@ env:
   - PROJAX_AUTO_MIGRATE=on
   - SUPABASE_URL=https://supa.flexsiebels.de
   - DAV_URL=https://dav.msbls.de/dav/calendars/m/
+  - GITEA_URL=https://mgit.msbls.de
 secrets:
   - PROJAX_DB_URL
   - SUPABASE_ANON_KEY
   - DAV_USER
   - DAV_PASSWORD
+  - GITEA_TOKEN   # = GITEA_TOKEN_AI from .env.age (mAi automation account)