Remove public Gitea NodePort side door

helm/gitea-registry-values.yaml

@@ -1,4 +1,11 @@
-# Non-secret Gitea registry settings layered after the SOPS values file.
+# Non-secret Gitea public endpoint and registry settings layered after the SOPS
+# values file.
+service:
+  http:
+    # Public web/API access is provided by manifests/gitea-ingress.yaml.
+    # Keep the Service internal so the raw node IP:port path is not a
+    # supported or reachable Gitea entry point.
+    type: ClusterIP
 gitea:
   config:
     packages: