Manage Gitea users; add teabot personality bot accounts

Add a data-driven 'user' config kind so Gitea accounts are declared as
config/git.unkin.net/user/<name>.yaml, mirroring the existing repository
and team kinds. Wire the yaml into a new modules/user submodule that
creates a gitea_user (provider go-gitea/gitea 0.7.0, already pinned).

The provider's user resource requires a password; generate a per-user
random_password so nothing sensitive is hardcoded and only a placeholder
lives in state (tokens come later from vault-plugin-secrets-gitea).

Provision teabot's implementer and reviewer personality accounts with a
conservative posture: not site admins, no org creation, no repo creation,
limited profile visibility.

Claude-Session: https://claude.ai/code/session_015ur3i7D2azsMAWTSVABApv

modules/gitea_instance/main.tf

@@ -38,6 +38,25 @@ module "repository" {
   depends_on = [module.organisation]
 }
 
+module "user" {
+  source = "./modules/user"
+
+  for_each = var.user
+
+  username                  = each.value.username
+  email                     = each.value.email
+  login_name                = each.value.login_name
+  full_name                 = each.value.full_name
+  description               = each.value.description
+  visibility                = each.value.visibility
+  admin                     = each.value.admin
+  restricted                = each.value.restricted
+  active                    = each.value.active
+  allow_create_organization = each.value.allow_create_organization
+  max_repo_creation         = each.value.max_repo_creation
+  must_change_password      = each.value.must_change_password
+}
+
 module "team" {
   source = "./modules/team"