Reduce secret syncing to just .env

Strip hardcoded secrets from gitea/config/app.ini (already injected
via GITEA__ env vars) and commit it to git. Add download.sh to fetch
the act_runner binary on demand instead of syncing it. Everything else
(searxng settings, certbot certs, runner registration, Spotify tokens)
is generated at runtime.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

gitea-runner/run.sh

@@ -1,5 +1,10 @@
 #!/usr/bin/env bash
 
+if [ ! -f ./act_runner ]; then
+    echo "act_runner binary not found. Downloading..." >&2
+    bash "$(dirname "$0")/download.sh"
+fi
+
 echo "Waiting for localhost:3000 to respond..." >&2
 
 while ! curl -sf http://localhost:3000 > /dev/null 2>&1; do