Manage Gitea users; add teabot personality bot accounts

Add a data-driven 'user' config kind so Gitea accounts are declared as
config/git.unkin.net/user/<name>.yaml, mirroring the existing repository
and team kinds. Wire the yaml into a new modules/user submodule that
creates a gitea_user (provider go-gitea/gitea 0.7.0, already pinned).

The provider's user resource requires a password; generate a per-user
random_password so nothing sensitive is hardcoded and only a placeholder
lives in state (tokens come later from vault-plugin-secrets-gitea).

Provision teabot's implementer and reviewer personality accounts with a
conservative posture: not site admins, no org creation, no repo creation,
limited profile visibility.

Claude-Session: https://claude.ai/code/session_015ur3i7D2azsMAWTSVABApv

config/config.hcl

@@ -33,6 +33,14 @@ locals {
       })
       if length(regexall("/team/", file_path)) > 0
     }
+    user = {
+      for file_path, content in local.all_configs :
+      "${split("/", file_path)[0]}/${trimsuffix(basename(file_path), ".yaml")}" => merge(content, {
+        username  = trimsuffix(basename(file_path), ".yaml")
+        gitea_url = split("/", file_path)[0]
+      })
+      if length(regexall("/user/", file_path)) > 0
+    }
     branch_protection = merge([
       for file_path, content in local.all_configs : {
         for idx, rule in try(content.branch_protection, []) :