Initial scaffold: API service, K8s operator, and CRDs

Forgebot is a K8s operator + API service for dispatching AI agent
jobs from git forge commands. Includes:

- CRDs: AgentPool, AgentTask, ProviderQueue, RepositoryBinding
- API server with webhook handler, task queue, and comment proxy
- Operator controllers for task scheduling and job management
- Gitea provider with webhook parsing and signature verification
- PostgreSQL database with auto-migration
- Woodpecker CI pipelines and multi-stage Dockerfiles

internal/apiserver/config.go

@@ -0,0 +1,51 @@
+package apiserver
+
+import (
+	"fmt"
+	"os"
+	"strconv"
+)
+
+type Config struct {
+	ListenAddr    string
+	DBHost        string
+	DBPort        int
+	DBUser        string
+	DBPass        string
+	DBName        string
+	DBSSL         string
+	WebhookSecret string
+	GiteaURL      string
+	GiteaToken    string
+}
+
+func (c *Config) DatabaseDSN() string {
+	return fmt.Sprintf("postgres://%s:%s@%s:%d/%s?sslmode=%s",
+		c.DBUser, c.DBPass, c.DBHost, c.DBPort, c.DBName, c.DBSSL)
+}
+
+func LoadConfig() (*Config, error) {
+	dbPort, err := strconv.Atoi(getenv("DBPORT", "5432"))
+	if err != nil {
+		return nil, fmt.Errorf("invalid DBPORT: %w", err)
+	}
+	return &Config{
+		ListenAddr:    getenv("LISTEN_ADDR", ":8000"),
+		DBHost:        getenv("DBHOST", "localhost"),
+		DBPort:        dbPort,
+		DBUser:        getenv("DBUSER", "forgebot"),
+		DBPass:        getenv("DBPASS", ""),
+		DBName:        getenv("DBNAME", "forgebot"),
+		DBSSL:         getenv("DBSSL", "disable"),
+		WebhookSecret: getenv("WEBHOOK_SECRET", ""),
+		GiteaURL:      getenv("GITEA_URL", "https://git.unkin.net"),
+		GiteaToken:    getenv("GITEA_TOKEN", ""),
+	}, nil
+}
+
+func getenv(key, fallback string) string {
+	if v := os.Getenv(key); v != "" {
+		return v
+	}
+	return fallback
+}