🐛 Fix passkeys behind TLS reverse proxy 🐛

Gitea now always listens on plain http while ROOT_URL carries the
public https origin, per Gitea's reverse-proxy docs. Fixes fresh
containers failing to start (PROTOCOL = https with no cert) and
passkey origin mismatches behind a proxy.

- rootfs/usr/local/etc/docker/init.d/08-gitea.sh: add __gitea_ini_set helper; stamp [server] PROTOCOL = http, ROOT_URL from new GITEA_ROOT_URL (trailing slash), and [session] COOKIE_SECURE from ROOT_URL scheme on every startup
- rootfs/tmp/etc/gitea/app.ini: default PROTOCOL to http instead of the public protocol placeholder
- README.md: document GITEA_PROTO as the public protocol (default https), GITEA_ROOT_URL, and reverse-proxy/passkey requirements; compose example uses https
- TODO.AI.md: record the fix and log the generated __create_ssl_cert crash

Claude-Session: https://claude.ai/code/session_01Kae22tmhzhmfHyqc34PZbx

README.md

@@ -64,7 +64,8 @@ services:
       TZ: ${TZ:-America/New_York}
       CONTAINER_NAME: casjaysdevdocker-gitea-latest
       HOSTNAME: ${BASE_HOST_NAME:-git.example.com}
-      GITEA_PROTO: http
+      # public protocol served by the proxy; must be https for passkeys
+      GITEA_PROTO: https
       DATABASE_DIR_SQLITE: /data/db/sqlite
     volumes:
       - ./volumes/data:/data:z
@@ -99,7 +100,8 @@ networks:
 | `GITEA_HOSTNAME` | _(empty)_ | Alias for `GITEA_SERVER` |
 | `FULL_DOMAIN_NAME` | _(empty)_ | Fallback FQDN used when neither `GITEA_SERVER` nor `GITEA_HOSTNAME` is set |
 | `DOMAIN` | _(empty)_ | Overrides the domain used in email addresses (takes precedence over `GITEA_SERVER`) |
-| `GITEA_PROTO` | `http` | Protocol used in ROOT\_URL (`http` or `https`) |
+| `GITEA_PROTO` | `https` | Public (browser-facing) protocol used in ROOT\_URL (`http` or `https`); use `https` behind a TLS reverse proxy |
+| `GITEA_ROOT_URL` | `$GITEA_PROTO://$DOMAIN/` | Full public URL; set it when the proxy uses a non-standard port or sub-path |
 | `GITEA_PORT` | `80` | Internal port Gitea listens on |
 | `GITEA_NAME` | `SelfHosted GIT Server` | Site title shown in the UI |
 | `GITEA_TZ` | `$TZ` | Override timezone for Gitea specifically |
@@ -134,6 +136,12 @@ networks:
 | `GITEA_SQL_NAME` | _(empty)_ | Database name (external DB only) |
 | `DATABASE_DIR_SQLITE` | `$DATA_DIR/db/sqlite` | Override the SQLite database directory (mount a separate volume here to keep the DB outside `/data`) |
 
+**Behind a TLS reverse proxy (passkeys/WebAuthn)** — passkeys only work when `ROOT_URL` matches the
+browser's address exactly and `DOMAIN` is the bare hostname. Set `DOMAIN` (or `GITEA_SERVER`) to the
+public hostname and keep `GITEA_PROTO=https`; Gitea keeps listening on plain http, marks session cookies
+`Secure`, and the proxy must forward `Host` and `X-Forwarded-Proto`. Use `GITEA_ROOT_URL` for a
+non-standard port or sub-path.
+
 **act\_runner**
 
 | Variable | Default | Description |