Initial scaffold: API service, K8s operator, and CRDs

Forgebot is a K8s operator + API service for dispatching AI agent
jobs from git forge commands. Includes:

- CRDs: AgentPool, AgentTask, ProviderQueue, RepositoryBinding
- API server with webhook handler, task queue, and comment proxy
- Operator controllers for task scheduling and job management
- Gitea provider with webhook parsing and signature verification
- PostgreSQL database with auto-migration
- Woodpecker CI pipelines and multi-stage Dockerfiles

internal/controller/repositorybinding_controller.go

@@ -0,0 +1,41 @@
+package controller
+
+import (
+	"context"
+
+	"k8s.io/apimachinery/pkg/runtime"
+	ctrl "sigs.k8s.io/controller-runtime"
+	"sigs.k8s.io/controller-runtime/pkg/client"
+	"sigs.k8s.io/controller-runtime/pkg/log"
+
+	forgebotv1alpha1 "git.unkin.net/unkin/forgebot/api/v1alpha1"
+)
+
+type RepositoryBindingReconciler struct {
+	client.Client
+	Scheme *runtime.Scheme
+}
+
+// +kubebuilder:rbac:groups=forgebot.unkin.net,resources=repositorybindings,verbs=get;list;watch;create;update;patch;delete
+// +kubebuilder:rbac:groups=forgebot.unkin.net,resources=repositorybindings/status,verbs=get;update;patch
+
+func (r *RepositoryBindingReconciler) Reconcile(ctx context.Context, req ctrl.Request) (ctrl.Result, error) {
+	logger := log.FromContext(ctx)
+
+	var binding forgebotv1alpha1.RepositoryBinding
+	if err := r.Get(ctx, req.NamespacedName, &binding); err != nil {
+		return ctrl.Result{}, client.IgnoreNotFound(err)
+	}
+
+	// TODO: Validate that referenced pool and queue exist
+	// TODO: Register webhook with Gitea for this repository
+
+	logger.V(1).Info("reconciled binding", "repo", binding.Spec.Repository)
+	return ctrl.Result{}, nil
+}
+
+func (r *RepositoryBindingReconciler) SetupWithManager(mgr ctrl.Manager) error {
+	return ctrl.NewControllerManagedBy(mgr).
+		For(&forgebotv1alpha1.RepositoryBinding{}).
+		Complete(r)
+}