infra: wire GKE cluster endpoint and fix gitea SA account_id

- Replace GKE_CLUSTER_ENDPOINT placeholder with real endpoint (34.63.89.52)
  in all three Argo CD Application manifests
- Fix gitea GCP SA account_id from 'gitea' (5 chars, too short) to 'gitea-gke'
  to satisfy GCP's 6-30 char constraint
- Update serviceaccount.yaml annotation to match new SA email (gitea-gke@...)

servers/gcp/cloud-sql.tf

@@ -174,7 +174,7 @@ resource "google_sql_user" "gitea" {
 # ── Gitea service account (for Workload Identity → Cloud SQL) ─────────────────
 
 resource "google_service_account" "gitea" {
-  account_id   = "gitea"
+  account_id   = "gitea-gke"
   display_name = "Gitea GKE SA"
   description  = "Service account for the Gitea pod on GKE. Used by the Cloud SQL Auth Proxy sidecar via Workload Identity."
   project      = var.project_id