Add secrets support to Gitea Actions workflow

- Create .env dynamically from Gitea secrets and variables
- Add SECRETS.md with configuration instructions
- Use secrets for sensitive data (PG_PASS, AUTHENTIK_SECRET_KEY)
- Use variables for non-sensitive config

.gitea/workflows/deploy.yml

@@ -8,9 +8,33 @@ jobs:
   #───────────────── deploy ─────────────────
   deploy:
     runs-on: docker
+    env:
+      PG_PASS: ${{ secrets.PG_PASS }}
+      PG_USER: ${{ vars.PG_USER }}
+      PG_DB: ${{ vars.PG_DB }}
+      AUTHENTIK_SECRET_KEY: ${{ secrets.AUTHENTIK_SECRET_KEY }}
+      AUTHENTIK_ERROR_REPORTING__ENABLED: ${{ vars.AUTHENTIK_ERROR_REPORTING__ENABLED }}
+      AUTHENTIK_IMAGE: ${{ vars.AUTHENTIK_IMAGE }}
+      AUTHENTIK_TAG: ${{ vars.AUTHENTIK_TAG }}
+      COMPOSE_PORT_HTTP: ${{ vars.COMPOSE_PORT_HTTP }}
+      COMPOSE_PORT_HTTPS: ${{ vars.COMPOSE_PORT_HTTPS }}
     steps:
       - uses: actions/checkout@v3
 
+      - name: Create .env file from secrets
+        run: |
+          cat > .env << EOF
+          PG_PASS=${{ secrets.PG_PASS }}
+          PG_USER=${{ vars.PG_USER }}
+          PG_DB=${{ vars.PG_DB }}
+          AUTHENTIK_SECRET_KEY=${{ secrets.AUTHENTIK_SECRET_KEY }}
+          AUTHENTIK_ERROR_REPORTING__ENABLED=${{ vars.AUTHENTIK_ERROR_REPORTING__ENABLED }}
+          AUTHENTIK_IMAGE=${{ vars.AUTHENTIK_IMAGE }}
+          AUTHENTIK_TAG=${{ vars.AUTHENTIK_TAG }}
+          COMPOSE_PORT_HTTP=${{ vars.COMPOSE_PORT_HTTP }}
+          COMPOSE_PORT_HTTPS=${{ vars.COMPOSE_PORT_HTTPS }}
+          EOF
+
       - name: Ensure external docker network exists
         run: |
           docker network inspect principal >/dev/null 2>&1 || docker network create principal