fix(gitea): retire deprecated [server] LFS_CONTENT_PATH; disable query auth tokens

Gitea 1.21.4 logs a deprecation warning for [server] LFS_CONTENT_PATH
(superseded by [lfs] PATH) and recommends DISABLE_QUERY_AUTH_TOKEN
(default from 1.23). Both surface as startup notices on the admin
dashboard.

Add the replacements as GITEA__ env overrides so they are tracked in
git. environment-to-ini can only add keys, so the stale
[server] LFS_CONTENT_PATH was also removed from the on-PVC app.ini by
hand (same path value -> existing data/lfs objects untouched).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

kubernetes/apps/gitea/statefulset.yaml

@@ -99,6 +99,20 @@ spec:
               value: "@every 6h"
             - name: GITEA__cron_0X2E_cleanup_packages__OLDER_THAN
               value: "4h"
+            # LFS storage path. Gitea deprecated [server] LFS_CONTENT_PATH in
+            # favour of [lfs] PATH (removal warning shows in the admin dashboard).
+            # Unlike the pure overrides above, env-to-ini can only ADD keys, not
+            # remove them, so the stale [server] LFS_CONTENT_PATH had to be deleted
+            # from the on-PVC app.ini by hand as part of this change; this env var
+            # is the tracked source for the replacement key. Same path value, so
+            # existing LFS objects under data/lfs are untouched.
+            - name: GITEA__lfs__PATH
+              value: /var/lib/gitea/data/lfs
+            # Disable query-string (?token=) API auth. Recommended by Gitea and the
+            # default from 1.23; clears the second startup notice on the dashboard.
+            # Nothing here authenticates via query tokens (CI uses webhooks/OAuth).
+            - name: GITEA__security__DISABLE_QUERY_AUTH_TOKEN
+              value: "true"
           ports:
             - name: http
               containerPort: 3000