gitea: consume the KV admin seed only at engine-config creation

Why: after the engine is first configured, rotate-root changes the live admin
password so it diverges from the KV seed. Re-reading the (possibly stale) seed
on a later apply must not push it back and clobber the rotated password. Ben
asked that the seed be used only when initially creating the config.

Change:
- Add lifecycle ignore_changes on admin_username/admin_password to the
  gitea_secret_backend resource, making the module create-only for the seeded
  credential. Noted inline that the rancher/litellm seed modules lack this.

Claude-Session: https://claude.ai/code/session_015ur3i7D2azsMAWTSVABApv

modules/vault_cluster/modules/gitea_secret_backend/main.tf

@@ -20,4 +20,15 @@ resource "gitea_secret_backend" "this" {
   ca_cert                 = var.ca_cert
   tls_skip_verify         = var.tls_skip_verify
   request_timeout_seconds = var.request_timeout_seconds
+
+  lifecycle {
+    # The KV seed is a bootstrap credential: it is consumed only when the engine
+    # config is first created. After creation the live admin password is rotated
+    # in place (vault write -f gitea/config/rotate-root) and diverges from the
+    # seed, so re-reading the (possibly stale) KV value must never push it back.
+    # Ignoring the credential attributes makes this module create-only for them.
+    # (The sibling rancher/litellm seed modules do not yet do this and would
+    # re-push their seed on a subsequent apply.)
+    ignore_changes = [admin_username, admin_password]
+  }
 }