Document API/direct-URL fallback for missing Gitea Secrets tab

Some Gitea/Forgejo versions drop the Secrets nav link from Settings ->
Actions while Runners and Variables still show, even though the page
and API underneath still work. Document the direct-URL and curl-based
workarounds so the token-rotation/auto-provisioning bootstrap isn't
blocked by it.

README.md

@@ -154,6 +154,37 @@ flowing into the secret automatically:
 Until those secrets exist, `coder-templates.yml` will run and fail cleanly
 at the `coder templates push` step rather than doing anything destructive.
 
+**If the Secrets tab doesn't show up** (some Gitea/Forgejo versions drop the
+*Secrets* nav link from Settings -> Actions while *Runners* and *Variables*
+still show, even though the page and API underneath both still work - see
+[forgejo#938](https://codeberg.org/forgejo/forgejo/issues/938)), try either:
+
+1. Go straight to the URL the nav link would normally point at:
+   `https://<gitea-host>/<owner>/<repo>/settings/actions/secrets`. If a
+   working "Add Secret" form loads there, it's just a missing nav link - add
+   the secrets on that page as normal.
+2. If that also won't load, set the secrets via the Actions Secrets API
+   instead, using a Gitea personal access token (`write:repository` scope,
+   Settings -> Applications -> Generate New Token):
+   ```sh
+   GITEA_PAT="<your Gitea PAT>"
+   OWNER=octoturge
+   REPO=Profiles-for-Coder
+
+   curl -s -X PUT "https://<gitea-host>/api/v1/repos/$OWNER/$REPO/actions/secrets/CODER_URL" \
+     -H "Authorization: token $GITEA_PAT" -H "Content-Type: application/json" \
+     -d '{"data":"https://code.octoturge.com"}'
+
+   curl -s -X PUT "https://<gitea-host>/api/v1/repos/$OWNER/$REPO/actions/secrets/CODER_SESSION_TOKEN" \
+     -H "Authorization: token $GITEA_PAT" -H "Content-Type: application/json" \
+     -d "{\"data\":\"$(coder tokens create --name gitea-ci --lifetime 168h)\"}"
+   ```
+   A `201`/`204` response means the secret was saved. This is the exact same
+   endpoint `rotate-coder-token.yml` uses at runtime, so if it works here it
+   confirms the workflow itself will be able to update the secret later too.
+   Never paste a PAT or Coder token into a chat/ticket - run these commands
+   from a trusted shell only.
+
 ### Token rotation (Gitea Actions)
 
 `.gitea/workflows/rotate-coder-token.yml` runs daily and keeps
@@ -170,7 +201,12 @@ workflow write to its own repo's secrets):
 1. Create a Gitea personal access token with **write:repository** scope and
    **no expiration** (Settings -> Applications -> Generate New Token). This
    one doesn't rotate itself, so give it a long life up front.
-2. Add it as a repo/org Actions secret named `GITEA_ROTATION_TOKEN`.
+2. Add it as a repo/org Actions secret named `GITEA_ROTATION_TOKEN` (same
+   Settings -> Actions -> Secrets page as above - if that tab is missing,
+   see the nav-link workaround / API fallback in the "Auto-provisioning"
+   section above, same `curl -X PUT .../actions/secrets/<name>` pattern,
+   just with `GITEA_ROTATION_TOKEN` as the secret name and the PAT itself as
+   the value).
 
 After that, `CODER_SESSION_TOKEN` never needs manual attention again - you
 can also trigger a rotation on demand from Gitea's Actions tab