recipe-maintainer: public snapshot (secrets + deployment plans removed, single commit)

Sanitized single-commit public mirror of recipe-maintainer.
- Removed test-ssh/.testenv (live creds); added test-ssh/.testenv.example placeholders.
- Removed plans/ and planned-updates/ (deployment-planning docs) so no client/
  deployment domains appear in the public repo.
- All other secret stores were already gitignored.
- docs.coopcloud.tech retained as a submodule (public upstream).

recipe-info/gitea/setup.md

@@ -0,0 +1,35 @@
+# Gitea — First-Time Setup
+
+## Prerequisites
+
+- DNS: `gitea.<DOMAIN_SUFFIX>` must resolve to the server
+
+## Steps
+
+1. **Create the app:**
+   ```bash
+   abra app new gitea --server <SERVER> --domain gitea.<DOMAIN_SUFFIX> --no-input
+   ```
+
+2. **Generate secrets:**
+   ```bash
+   abra app secret generate gitea.<DOMAIN_SUFFIX> --all -m --no-input
+   ```
+   Save output to `recipe-info/testsecrets/gitea.<DOMAIN_SUFFIX>`.
+
+3. **Deploy:**
+   ```bash
+   abra app deploy gitea.<DOMAIN_SUFFIX> --chaos --force --no-input
+   ```
+
+4. **Create the first admin user:**
+   ```bash
+   abra app run gitea.<DOMAIN_SUFFIX> app gitea -c /etc/gitea/app.ini admin user create \
+     --username admin --admin --random-password --email admin@example.com
+   ```
+
+5. **Verify:** curl `https://gitea.<DOMAIN_SUFFIX>` returns HTTP 200.
+
+## SSH Access (optional)
+
+To expose Gitea's SSH service, configure Traefik to enable the `gitea-ssh` entrypoint and set `GITEA_SSH_PORT=2222` in the app env file.