jupiter: enable gitea Actions + register a jupiter runner

Runner registers against the same gitea instance and runs jobs in podman
containers (services/containers.nix), one image per runs-on label using the
catthehacker act-compatible images. Registration token comes from gitea
itself (gitea actions generate-runner-token) and is stored in
secrets/jupiter.yaml, rendered into a TOKEN=... env file via sops.templates
since gitea-actions-runner takes an EnvironmentFile, not a raw secret path.

hosts/jupiter/secrets.nix

@@ -34,4 +34,12 @@
   # sops default of root:root 0400 is correct — do NOT set `owner`.
   sops.secrets.immich_oauth_client_secret = { };
 
+  # Gitea Actions runner registration token (services/dev/gitea.nix). Gitea
+  # generates this itself once Actions is enabled — it is not a password
+  # chosen up front. Rendered into a `TOKEN=...` env file because
+  # gitea-actions-runner takes an EnvironmentFile, not a raw secret path.
+  sops.secrets.gitea_runner_token = { };
+  sops.templates."gitea-runner.env".content =
+    "TOKEN=${config.sops.placeholder.gitea_runner_token}";
+
 }