Add daily Coder token auto-rotation workflow

This Coder deployment caps API token lifetime at 168h (7 days), so
rather than raising that cap deployment-wide, add
.gitea/workflows/rotate-coder-token.yml: runs daily, mints a new 168h
coder token, PUTs it into this repo's CODER_SESSION_TOKEN secret via
Gitea's actions/secrets API (confirmed against the live instance's
swagger.v1.json - PUT /repos/{owner}/{repo}/actions/secrets/{name} with
{"data": "..."}), then deletes the token(s) it replaced. Old token isn't
touched until the new one is confirmed live, so a failed run fails safe.

Needs a one-time GITEA_ROTATION_TOKEN secret (a Gitea PAT with
write:repository scope, no expiration) so the workflow can write to its
own repo's secrets going forward - documented in README. After that,
CODER_SESSION_TOKEN (used by coder-templates.yml) never needs manual
attention again.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

README.md

@@ -134,19 +134,44 @@ It runs on the `ubuntu-latest` self-hosted runner already registered on this
 Gitea instance and installs the `coder` CLI itself via `coder.com/install.sh`.
 
 **One-time setup required** (not something this workflow can do for itself -
-needs a human with Coder access):
+needs a human with Coder access). This deployment caps API token lifetime at
+168h (7 days), so rather than raising that cap deployment-wide,
+`.gitea/workflows/rotate-coder-token.yml` (see below) keeps a fresh token
+flowing into the secret automatically:
 
 1. Create a Coder API token - ideally under a dedicated service account
    rather than a personal login, since this token can create/delete
    templates:
    ```sh
    coder login https://code.octoturge.com
-   coder tokens create --name gitea-ci --lifetime 8760h
+   coder tokens create --name gitea-ci --lifetime 168h
    ```
 2. In Gitea, go to this repo's **Settings -> Actions -> Secrets** (or the
    org-level equivalent to share across repos) and add:
    - `CODER_URL` = `https://code.octoturge.com`
    - `CODER_SESSION_TOKEN` = the token printed by step 1
 
-Until those secrets exist, the workflow will run and fail cleanly at the
-`coder templates push` step rather than doing anything destructive.
+Until those secrets exist, `coder-templates.yml` will run and fail cleanly
+at the `coder templates push` step rather than doing anything destructive.
+
+### Token rotation (Gitea Actions)
+
+`.gitea/workflows/rotate-coder-token.yml` runs daily and keeps
+`CODER_SESSION_TOKEN` alive forever without anyone needing to remember to
+refresh it: it mints a new 168h Coder token, writes it into the
+`CODER_SESSION_TOKEN` secret via the Gitea API, then deletes the token(s) it
+just replaced. If a run ever fails, the previous token is still untouched
+and still valid (nothing gets deleted until the new one is confirmed live),
+so it fails safe rather than locking you out.
+
+**One-time bootstrap** (also needs a human - this is what lets the rotation
+workflow write to its own repo's secrets):
+
+1. Create a Gitea personal access token with **write:repository** scope and
+   **no expiration** (Settings -> Applications -> Generate New Token). This
+   one doesn't rotate itself, so give it a long life up front.
+2. Add it as a repo/org Actions secret named `GITEA_ROTATION_TOKEN`.
+
+After that, `CODER_SESSION_TOKEN` never needs manual attention again - you
+can also trigger a rotation on demand from Gitea's Actions tab
+(`workflow_dispatch`) instead of waiting for the daily schedule.