Fix Gitea init: must-change-password flag syntax + auth check

- Use --must-change-password=false (equals syntax) in gitea CLI
  The space-separated form was parsed as boolean flag + extra arg
- Fix auto-setup readiness check: use Basic Auth instead of
  unauthenticated /version endpoint (blocked by REQUIRE_SIGNIN_VIEW)
- Increase retries to 8 to accommodate gitea-init container startup

Bunker Admin

scripts/gitea-init.sh

@@ -14,6 +14,12 @@ log()  { echo "$PREFIX $1"; }
 # The gitea binary needs app.ini to know the database connection.
 # On the Gitea Docker image, GITEA_CUSTOM defaults to /data/gitea
 # and app.ini lives at /data/gitea/conf/app.ini (created by gitea-app's entrypoint).
+# Gitea refuses to run as root. The init container bypasses the Gitea entrypoint,
+# so we must drop privileges ourselves. Re-exec as 'git' user via su-exec.
+if [ "$(id -u)" = "0" ]; then
+  exec su-exec git "$0" "$@"
+fi
+
 export GITEA_CUSTOM="${GITEA_CUSTOM:-/data/gitea}"
 
 if [ ! -f "$GITEA_CUSTOM/conf/app.ini" ]; then
@@ -35,7 +41,7 @@ if gitea admin user create --admin \
   --username "$GITEA_ADMIN_USER" \
   --password "$GITEA_ADMIN_PASSWORD" \
   --email "$GITEA_ADMIN_EMAIL" \
-  --must-change-password false 2>&1; then
+  --must-change-password=false 2>&1; then
   log "Admin user created successfully"
 else
   log "Admin user already exists (or creation skipped)"