Pin gitea SSH_LISTEN_PORT to 2222

The rootless image defaulted SSH_LISTEN_PORT to SSH_PORT until 1.26; in
1.27 docker-setup.sh leaves it empty, so Gitea fell back to SSH_PORT=22
and crash-looped with "listen tcp :22: bind: permission denied" as uid
1000. The Service already maps 22 -> 2222, so pin the listen port
explicitly rather than depending on an image default.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

gitea/application.yaml

@@ -139,6 +139,13 @@ spec:
               value: "/cert/tls.key"
             - name: GITEA__SERVER__SSH_PORT
               value: "22"
+            # Port advertised in clone URLs is 22, but the rootless container
+            # cannot bind it, so the builtin server listens on 2222 and the
+            # Service maps 22 -> 2222. Until 1.26 the image defaulted
+            # SSH_LISTEN_PORT to SSH_PORT; it is empty now, which makes Gitea
+            # fall back to SSH_PORT and crash with "bind: permission denied".
+            - name: GITEA__SERVER__SSH_LISTEN_PORT
+              value: "2222"
             - name: GITEA__SERVER__PROTOCOL
               value: https
             - name: GITEA__SERVER__REDIRECT_OTHER_PORT