Add Gitea act-runner and fix ddclient deployment

- gitea-runner.tf: Secret for Gitea runner registration token
- apps/gitea-runner.yaml: Gitea act-runner deployment (init container
  registers with Gitea, main container runs daemon) — serves all Gitea
  Actions CI jobs on self-hosted,linux,x64,legion labels
- variables.tf: Add gitea_runner_token variable
- ddclient.tf: Switch to official ghcr.io/ddclient/ddclient image,
  remove linuxserver wrapper that was exhausting inotify instances

servers/legion/ddclient.tf

@@ -42,21 +42,13 @@ resource "kubernetes_deployment" "ddclient" {
       }
       spec {
         container {
-          name  = "ddclient"
-          image = "ghcr.io/linuxserver/ddclient:latest"
-
-          env {
-            name  = "PUID"
-            value = "1000"
-          }
-          env {
-            name  = "PGID"
-            value = "1000"
-          }
+          name    = "ddclient"
+          image   = "ghcr.io/ddclient/ddclient:latest"
+          command = ["ddclient", "-file", "/etc/ddclient/ddclient.conf", "-daemon", "300", "-noquiet", "-foreground"]
 
           volume_mount {
             name       = "config"
-            mount_path = "/config/ddclient.conf"
+            mount_path = "/etc/ddclient/ddclient.conf"
             sub_path   = "ddclient.conf"
             read_only  = true
           }