Make gitea OAuth2 JWT_SECRET a valid, stable 43-char key

GITEA__OAUTH2__JWT_SECRET must base64url-decode to 32 bytes. The size-32
claim decoded to 24 bytes, so 1.27 rejected it and generated its own key
on each boot; since app.ini lives on an emptyDir that regenerated every
restart and logged out all OAuth2 clients. size 43 decodes to 32 bytes,
so the rotated key is accepted and stays stable across restarts.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

gitea/application.yaml

@@ -49,12 +49,17 @@ spec:
     - key: GITEA__SECURITY__INTERNAL_TOKEN
       value: "%(plaintext)s"
 ---
+# size 43: GITEA__OAUTH2__JWT_SECRET must base64url-decode to exactly 32 bytes.
+# A 43-char value decodes to 32 bytes; a 32-char one decodes to 24 and Gitea
+# rejects it and generates its own key each boot, which (app.ini is on an
+# emptyDir) changes on every restart and logs out all OAuth2 clients. 43 keeps
+# the rotated key valid and stable.
 apiVersion: codemowers.cloud/v1beta1
 kind: SecretClaim
 metadata:
   name: gitea-oauth2-jwt
 spec:
-  size: 32
+  size: 43
   mapping:
     - key: GITEA__OAUTH2__JWT_SECRET
       value: "%(plaintext)s"