Add Gitea act-runner and fix ddclient deployment

- gitea-runner.tf: Secret for Gitea runner registration token
- apps/gitea-runner.yaml: Gitea act-runner deployment (init container
  registers with Gitea, main container runs daemon) — serves all Gitea
  Actions CI jobs on self-hosted,linux,x64,legion labels
- variables.tf: Add gitea_runner_token variable
- ddclient.tf: Switch to official ghcr.io/ddclient/ddclient image,
  remove linuxserver wrapper that was exhausting inotify instances

servers/legion/gitea-runner.tf

@@ -0,0 +1,14 @@
+# Gitea act-runner — executes Gitea Actions CI jobs on Legion
+# Registered at the instance level so it can serve all repos/orgs
+
+resource "kubernetes_secret" "gitea_runner_secret" {
+  metadata {
+    name      = "gitea-runner-secret"
+    namespace = kubernetes_namespace.ci.metadata[0].name
+  }
+
+  data = {
+    GITEA_INSTANCE_URL    = "http://gitea.git.svc.cluster.local:3000"
+    GITEA_RUNNER_REGISTRATION_TOKEN = var.gitea_runner_token
+  }
+}