jupiter: enable gitea Actions + register a jupiter runner

Runner registers against the same gitea instance and runs jobs in podman
containers (services/containers.nix), one image per runs-on label using the
catthehacker act-compatible images. Registration token comes from gitea
itself (gitea actions generate-runner-token) and is stored in
secrets/jupiter.yaml, rendered into a TOKEN=... env file via sops.templates
since gitea-actions-runner takes an EnvironmentFile, not a raw secret path.

services/dev/gitea.nix

@@ -1,4 +1,4 @@
-{ ... }:
+{ config, ... }:
 
 # Gitea — self-hosted git. stateDir/repositories were migrated from the old
 # ZimaOS docker instance straight into stateDir's default layout, so no
@@ -34,10 +34,36 @@
       service = {
         DISABLE_REGISTRATION = true;
       };
+      actions = {
+        ENABLED = true;
+      };
     };
   };
 
   networking.firewall.allowedTCPPorts = [ 2222 ];
 
   users.users.gitea.extraGroups = [ "users" ];
+
+  # Runner instance registered against this same gitea. Jobs run in containers
+  # (podman, via services/containers.nix — already enabled on jupiter), one
+  # image per requested `runs-on` label using the catthehacker act-compatible
+  # images (same ones upstream `act`/Forgejo docs recommend).
+  #
+  # tokenFile points at an env file rendered by sops (TOKEN=<registration
+  # token>, see hosts/jupiter/secrets.nix) rather than a plain `token`, so the
+  # secret never lands in the Nix store. The registration token itself is NOT
+  # generated by this module — it comes from gitea once Actions is enabled:
+  #   su gitea -s /bin/sh -c \
+  #     'GITEA_WORK_DIR=/mnt/data/AppData/gitea gitea actions generate-runner-token'
+  # then written into secrets/jupiter.yaml as gitea_runner_token.
+  services.gitea-actions-runner.instances.jupiter = {
+    enable = true;
+    name = "jupiter";
+    url = "https://git.mgaction.town/";
+    tokenFile = config.sops.templates."gitea-runner.env".path;
+    labels = [
+      "ubuntu-latest:docker://ghcr.io/catthehacker/ubuntu:act-latest"
+      "ubuntu-22.04:docker://ghcr.io/catthehacker/ubuntu:act-22.04"
+    ];
+  };
 }