feat: add Gitea CI/CD with Vault-backed kubeconfig deploy

- Create CI workflow: lint, release, docker build+push, kustomize deploy
- Switch image registry from GHCR to internal Gitea registry
- Deploy job uses kubeconfig mounted from Vault via ESO
- Add ntfy notifications for success, deploy, and failure

llm.yaml

@@ -20,7 +20,7 @@ spec:
     spec:
       containers:
         - name: gradio
-          image: ghcr.io/billy-davies-2/llm-apps:v2-202602130804
+          image: gitea-http.gitea.svc.cluster.local:3000/daviestechlabs/gradio-ui:latest
           imagePullPolicy: Always
           command: ["python", "llm.py"]
           ports:
@@ -53,7 +53,7 @@ spec:
             initialDelaySeconds: 5
             periodSeconds: 10
       imagePullSecrets:
-        - name: ghcr-registry
+        - name: gitea-registry
 ---
 apiVersion: v1
 kind: Service