Reduce secret syncing to just .env

Strip hardcoded secrets from gitea/config/app.ini (already injected
via GITEA__ env vars) and commit it to git. Add download.sh to fetch
the act_runner binary on demand instead of syncing it. Everything else
(searxng settings, certbot certs, runner registration, Spotify tokens)
is generated at runtime.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

.gitignore

@@ -6,7 +6,6 @@ certbot/www
 backend/token/
 .env
 
-gitea/config/app.ini
 gitea/data/*
 
 # Gitea runner