team: stop spurious edits that fail Gitea 1.26 permission validation

Why:
- The go-gitea/gitea provider's SDK (v0.25.1, already shipped in provider
  0.8.1 on main) rejects a team permission of `none` on every EditTeam with
  "permission mode invalid"; it only accepts read/write/admin/owner
  client-side. The same check exists in the older 0.21.0 SDK, so the provider
  version is not the lever here.
- The team module's `units` (server returns an unordered space-separated
  string that never matches the provider's comma-ordered default) and
  `repositories` (provider sorts state; `include_all_repositories` populates
  every repo) drift on representation alone, so every apply plans an in-place
  update for every team.
- Each update calls EditTeam, which replays the stored `permission=none` kept
  by `ignore_changes` and fails, blocking apply for every non-owner team
  (docker/terraform/rpmbuild/puppet/pybuild/forgebot/agents) and the whole
  terraform-git apply, including the unkin-agent rollout.

Change:
- Add `units` and `repositories` to the team `ignore_changes` so provider
  representation churn no longer triggers an EditTeam call.
- Preserve each team's current on-server permission and repository membership
  (no access change).

modules/gitea_instance/modules/team/main.tf

@@ -8,7 +8,8 @@ resource "gitea_team" "this" {
   repositories             = var.repositories
 
   lifecycle {
-    ignore_changes = [permission]
+    # Gitea's SDK rejects the stored permission=none on any EditTeam call; units/repositories only churn on provider representation (unordered units string, sorted/include-all repos), so ignore them to avoid spurious edits that would fail.
+    ignore_changes = [permission, units, repositories]
   }
 }