Gitignore gitea app.ini and remove INTERNAL_TOKEN from template

Runtime config (app.ini) should not be tracked since secrets are
injected via env vars in docker-compose. The template remains as
source of truth. INTERNAL_TOKEN is removed from the template as
it is set exclusively via GITEA__security__INTERNAL_TOKEN env var.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

.gitignore

@@ -7,6 +7,7 @@ backend/token/
 .env
 
 gitea/data/*
+gitea/config/app.ini
 
 # Gitea runner
 gitea-runner/.runner