Manage Gitea users; add teabot personality bot accounts

Add a data-driven 'user' config kind so Gitea accounts are declared as
config/git.unkin.net/user/<name>.yaml, mirroring the existing repository
and team kinds. Wire the yaml into a new modules/user submodule that
creates a gitea_user (provider go-gitea/gitea 0.7.0, already pinned).

The provider's user resource requires a password; generate a per-user
random_password so nothing sensitive is hardcoded and only a placeholder
lives in state (tokens come later from vault-plugin-secrets-gitea).

Provision teabot's implementer and reviewer personality accounts with a
conservative posture: not site admins, no org creation, no repo creation,
limited profile visibility.

Claude-Session: https://claude.ai/code/session_015ur3i7D2azsMAWTSVABApv

config/config.hcl

@@ -33,6 +33,14 @@ locals {
       })
       if length(regexall("/team/", file_path)) > 0
     }
+    user = {
+      for file_path, content in local.all_configs :
+      "${split("/", file_path)[0]}/${trimsuffix(basename(file_path), ".yaml")}" => merge(content, {
+        username  = trimsuffix(basename(file_path), ".yaml")
+        gitea_url = split("/", file_path)[0]
+      })
+      if length(regexall("/user/", file_path)) > 0
+    }
     branch_protection = merge([
       for file_path, content in local.all_configs : {
         for idx, rule in try(content.branch_protection, []) :

config/git.unkin.net/user/teabot-implementer.yaml

@@ -0,0 +1,14 @@
+# teabot "implementer" personality account.
+# Used by the teabot daemon (unkin/teabot) to open issues/PRs as a distinct
+# identity so its work is attributable. Auth is via an API token issued
+# out-of-band (vault-plugin-secrets-gitea / static KV) -- no token or usable
+# password lives in this repo's state beyond the generated placeholder.
+email: teabot-implementer@unkin.net
+full_name: "Teabot Implementer"
+description: "teabot implementer bot -- automated agent (unkin/teabot)"
+# Conservative bot posture: not a site admin, cannot create orgs or repos,
+# profile visible only to signed-in users.
+visibility: limited
+admin: false
+allow_create_organization: false
+max_repo_creation: 0

config/git.unkin.net/user/teabot-reviewer.yaml

@@ -0,0 +1,14 @@
+# teabot "reviewer" personality account.
+# Used by the teabot daemon (unkin/teabot) to review pull requests as a distinct
+# identity so its reviews are attributable. Auth is via an API token issued
+# out-of-band (vault-plugin-secrets-gitea / static KV) -- no token or usable
+# password lives in this repo's state beyond the generated placeholder.
+email: teabot-reviewer@unkin.net
+full_name: "Teabot Reviewer"
+description: "teabot reviewer bot -- automated agent (unkin/teabot)"
+# Conservative bot posture: not a site admin, cannot create orgs or repos,
+# profile visible only to signed-in users.
+visibility: limited
+admin: false
+allow_create_organization: false
+max_repo_creation: 0