Add daily Coder token auto-rotation workflow

This Coder deployment caps API token lifetime at 168h (7 days), so
rather than raising that cap deployment-wide, add
.gitea/workflows/rotate-coder-token.yml: runs daily, mints a new 168h
coder token, PUTs it into this repo's CODER_SESSION_TOKEN secret via
Gitea's actions/secrets API (confirmed against the live instance's
swagger.v1.json - PUT /repos/{owner}/{repo}/actions/secrets/{name} with
{"data": "..."}), then deletes the token(s) it replaced. Old token isn't
touched until the new one is confirmed live, so a failed run fails safe.

Needs a one-time GITEA_ROTATION_TOKEN secret (a Gitea PAT with
write:repository scope, no expiration) so the workflow can write to its
own repo's secrets going forward - documented in README. After that,
CODER_SESSION_TOKEN (used by coder-templates.yml) never needs manual
attention again.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

.gitea/workflows/rotate-coder-token.yml

@@ -0,0 +1,83 @@
+name: Rotate Coder API Token
+
+# Keeps the CODER_SESSION_TOKEN secret (used by coder-templates.yml) alive
+# forever without anyone needing to remember to refresh it. This Coder
+# deployment caps token lifetime at 168h (7 days), so this runs daily,
+# mints a fresh 168h token, writes it back into this repo's
+# CODER_SESSION_TOKEN secret via the Gitea API, then deletes the token(s)
+# it replaced.
+#
+# One-time bootstrap (see README "Auto-provisioning" section): a
+# GITEA_ROTATION_TOKEN secret holding a Gitea personal access token
+# (write:repository scope, no expiration) with permission to write this
+# repo's Actions secrets. Nothing else needs to touch this ever again.
+
+on:
+  schedule:
+    - cron: "0 3 * * *"
+  workflow_dispatch: {}
+
+jobs:
+  rotate:
+    runs-on: ubuntu-latest
+    env:
+      CODER_URL: ${{ secrets.CODER_URL }}
+      CODER_SESSION_TOKEN: ${{ secrets.CODER_SESSION_TOKEN }}
+      GITEA_ROTATION_TOKEN: ${{ secrets.GITEA_ROTATION_TOKEN }}
+      GITEA_API_URL: ${{ github.server_url }}/api/v1
+      GITEA_REPO_PATH: ${{ github.repository }}
+    steps:
+      - name: Install coder CLI and jq
+        run: |
+          set -e
+          curl -fsSL https://coder.com/install.sh | sh
+          coder version
+          command -v jq >/dev/null 2>&1 || (apt-get update -qq && apt-get install -y -qq jq)
+
+      - name: Create a new token
+        id: new_token
+        run: |
+          set -e
+          NAME="gitea-ci-$(date -u +%Y%m%dT%H%M%SZ)"
+          TOKEN="$(coder tokens create --name "$NAME" --lifetime 168h)"
+          if [ -z "$TOKEN" ]; then
+            echo "::error::coder tokens create returned no token"
+            exit 1
+          fi
+          echo "::add-mask::$TOKEN"
+          echo "name=$NAME" >> "$GITHUB_OUTPUT"
+          echo "token=$TOKEN" >> "$GITHUB_OUTPUT"
+
+      - name: Publish new token to CODER_SESSION_TOKEN secret
+        env:
+          NEW_TOKEN: ${{ steps.new_token.outputs.token }}
+        run: |
+          set -e
+          BODY="$(jq -n --arg data "$NEW_TOKEN" '{data:$data}')"
+          HTTP_STATUS="$(curl -s -o /tmp/put-secret.out -w '%{http_code}' \
+            -X PUT \
+            -H "Authorization: token ${GITEA_ROTATION_TOKEN}" \
+            -H "Content-Type: application/json" \
+            -d "$BODY" \
+            "${GITEA_API_URL}/repos/${GITEA_REPO_PATH}/actions/secrets/CODER_SESSION_TOKEN")"
+          if [ "$HTTP_STATUS" != "201" ] && [ "$HTTP_STATUS" != "204" ]; then
+            echo "::error::Failed to update CODER_SESSION_TOKEN secret (HTTP $HTTP_STATUS)"
+            cat /tmp/put-secret.out
+            exit 1
+          fi
+          echo "CODER_SESSION_TOKEN secret updated (HTTP $HTTP_STATUS)."
+
+      - name: Delete the token(s) this replaced
+        env:
+          KEEP_NAME: ${{ steps.new_token.outputs.name }}
+        run: |
+          set -e
+          coder tokens list -o json \
+            | jq -r --arg keep "$KEEP_NAME" \
+                '.[] | select(.token_name | startswith("gitea-ci-")) | select(.token_name != $keep) | .id' \
+            | while read -r id; do
+                [ -z "$id" ] && continue
+                echo "Removing superseded token $id"
+                coder tokens delete "$id" --delete \
+                  || echo "::warning::Failed to delete superseded token $id"
+              done