Why: AI coding agents authenticate to Gitea as Ben using Ben's token. With
the unkin-agent identity now in place, the agents AppRole should issue that
account's tokens directly so agent commits and PRs are attributable and
carry only least-privilege scopes.
How:
- add a gitea secrets-engine role that mints ephemeral tokens for unkin-agent
scoped to write:repository, write:issue, read:user -- push branches and open
PRs, never merge or administer
- add a policy granting read on gitea/creds/unkin-agent and bind it to the
agents AppRole, mirroring the agent-* Kubernetes creds bindings
unkinben