Add Gitea integration for agent to push branches and open pull requests

- Implemented `register-gitea-bot.sh` to provision Gitea access token.
- Updated `maintainer.py` to support Gitea API for push and PR operations.
- Modified `install.sh` to warn if Gitea token is not provisioned.
- Enhanced documentation in `README.md`, `CLAUDE.md`, and `architecture.md` to reflect new Gitea functionality.
- Added Gitea configuration to `config.example.json`.

README.md

@@ -108,12 +108,35 @@ cp config.example.json config.json
 ./register-matrix-bot.sh
 #   then, one-time: accept the room invite in Element as @paul:semprini.me
 
-# 3. Install + start the service
+# 3. Provision the Gitea token (lets the agent push + open PRs as claude-code)
+./register-gitea-bot.sh
+
+# 4. Install + start the service
 ./install.sh
 ```
 
 `config.json` and `.bot-secrets` hold the bot token/password and are gitignored.
 
+### Pushing code & pull requests
+
+When the agent changes tracked files in a repo (compose files, configs, scripts,
+docs) it does **not** commit to `main` — it branches, commits, pushes, and opens
+a **pull request** on `git.semprini.me` (Gitea) for the operator to review, then
+reports the PR URL to Matrix. Live remediation that must restore service now
+(e.g. `docker compose up`) still happens immediately; only the git change is
+gated behind the PR.
+
+It authenticates as the **`claude-code`** user (an OIDC account in
+auth.semprini.me that is already a push-capable collaborator). `register-gitea-bot.sh`
+mints a Gitea personal access token via the gitea admin CLI inside the
+`user-gitea` container — git.semprini.me has password login and HTTP basic auth
+disabled, but a PAT still works for git-over-HTTPS and the API, so no SSH
+exposure or core-stack change is needed. The daemon hands the headless agent
+claude-code's git identity + credential (via `GIT_CONFIG_*`, scoped to
+git.semprini.me) and the Gitea API coordinates (`$GITEA_TOKEN`, `$GITEA_API`,
+`$GITEA_REPO`) so it can open the PR itself. Leaving `gitea.token` empty disables
+the workflow — the agent then edits/redeploys live without committing.
+
 ## Operate
 
 ```bash
@@ -134,6 +157,7 @@ python3 maintainer.py --config config.json --once replies
 | `maintainer.py` | The daemon. Stdlib only. |
 | `config.example.json` | Template — copy to `config.json`. |
 | `register-matrix-bot.sh` | Creates the `@maintainer` account + room, writes token to config. |
+| `register-gitea-bot.sh` | Mints the `claude-code` Gitea token for push + PRs, writes it to config. |
 | `semprini-maintainer.service` | systemd unit (runs as `paul`). |
 | `install.sh` | Syntax-check, install, enable, start. |