fix(gitea): cache-server needs external_secret, not external_secret_file

The cache-server subcommand only checks the literal external_secret
field at startup and errors out if just external_secret_file is set
(unlike the daemon, which handles _file fine). Move its config out of
git entirely - it now has to hold the actual secret value - generated
straight into .data on the VPS instead.

gitea/cache-server-config.yaml

@@ -1,5 +0,0 @@
-cache:
-  # Path to the shared secret file (generated on the VPS directly, outside
-  # git - see /root/stacks/.data/gitea/cache_secret). Must match
-  # external_secret_file in runner-config.yaml exactly.
-  external_secret_file: "/data/cache_secret"

gitea/compose.yml

@@ -110,8 +110,13 @@ services:
       - "8088:8088"
     volumes:
       - ../.data/gitea/runner-cache:/data/cache
-      - ./cache-server-config.yaml:/data/config.yaml:ro
+      # Unlike the daemon (runner-config.yaml, external_secret_file works
-      - ../.data/gitea/cache_secret:/data/cache_secret:ro
+      # fine there), the cache-server subcommand only checks the literal
+      # external_secret field and errors out ("must be set") if only
+      # external_secret_file is given. So this file has to hold the actual
+      # secret value - kept out of git entirely, generated straight into
+      # .data on the VPS (see the cache_secret file it reads from).
+      - ../.data/gitea/cache-server-config.yaml:/data/config.yaml:ro
     restart: always
     networks:
       - compose_network