Move Gitea deploy surface into forge

Makefile

@@ -3,9 +3,14 @@ SHELL := /usr/bin/env bash
 
 GITEA_RELEASE ?= gitea
 GITEA_NAMESPACE ?= default
+GITEA_CHART ?= gitea-charts/gitea
+GITEA_VALUES ?= helm/gitea-values.sops.yaml
+GITEA_REGISTRY_VALUES ?= helm/gitea-registry-values.yaml
+GITEA_INGRESS ?= manifests/gitea-ingress.yaml
 GITEA_DB_CLUSTER ?= gitea-db
 GITEA_DB_NAMESPACE ?= databases
 REGISTRY_DOCS ?= docs/gitea-container-registry.md docs/gitea-package-registry.md
+SOPS_SENTINEL ?= $(GITEA_VALUES)
 
 ##@ Operator checks
 
@@ -26,6 +31,9 @@ check-tools: ## Check local tools used by forge operator targets
 	fi; \
 	exit $$missing
 
+check-sops: ## Verify the configured SOPS sentinel can decrypt
+	sops -d $(SOPS_SENTINEL) >/dev/null
+
 registry-docs: ## Print canonical registry docs
 	@for doc in $(REGISTRY_DOCS); do \
 		printf '\n## %s\n\n' "$$doc"; \
@@ -34,6 +42,15 @@ registry-docs: ## Print canonical registry docs
 
 ##@ Current Gitea
 
+gitea-deploy: ## Deploy / upgrade current Gitea forge runtime
+	helm upgrade --install $(GITEA_RELEASE) $(GITEA_CHART) \
+		-f <(sops -d $(GITEA_VALUES)) \
+		-f $(GITEA_REGISTRY_VALUES) \
+		--namespace $(GITEA_NAMESPACE) --create-namespace
+
+gitea-ingress-deploy: ## Apply the Gitea OCI registry ingress
+	kubectl apply -f $(GITEA_INGRESS)
+
 gitea-status: ## Read-only status for current Gitea runtime and database
 	kubectl get pods -n $(GITEA_NAMESPACE) -l app.kubernetes.io/instance=$(GITEA_RELEASE)
 	kubectl get svc -n $(GITEA_NAMESPACE) $(GITEA_RELEASE) --ignore-not-found
@@ -53,4 +70,4 @@ help: ## Show this help
 	  /^[a-zA-Z0-9_-]+:.*?##/ { printf "  \033[36m%-20s\033[0m %s\n", $$1, $$2 } \
 	  /^##@/ { printf "\n\033[1m%s\033[0m\n", substr($$0, 5) }' $(MAKEFILE_LIST)
 
-.PHONY: check-tools registry-docs gitea-status help
+.PHONY: check-tools check-sops registry-docs gitea-deploy gitea-ingress-deploy gitea-status help