🐛 Fix passkeys behind TLS reverse proxy 🐛

Gitea now always listens on plain http while ROOT_URL carries the
public https origin, per Gitea's reverse-proxy docs. Fixes fresh
containers failing to start (PROTOCOL = https with no cert) and
passkey origin mismatches behind a proxy.

- rootfs/usr/local/etc/docker/init.d/08-gitea.sh: add __gitea_ini_set helper; stamp [server] PROTOCOL = http, ROOT_URL from new GITEA_ROOT_URL (trailing slash), and [session] COOKIE_SECURE from ROOT_URL scheme on every startup
- rootfs/tmp/etc/gitea/app.ini: default PROTOCOL to http instead of the public protocol placeholder
- README.md: document GITEA_PROTO as the public protocol (default https), GITEA_ROOT_URL, and reverse-proxy/passkey requirements; compose example uses https
- TODO.AI.md: record the fix and log the generated __create_ssl_cert crash

Claude-Session: https://claude.ai/code/session_01Kae22tmhzhmfHyqc34PZbx

rootfs/tmp/etc/gitea/app.ini

@@ -5,7 +5,7 @@ RUN_MODE                                                   = prod
 
 ; ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 [server]
-PROTOCOL                                                   = REPLACE_SERVER_PROTO
+PROTOCOL                                                   = http
 HTTP_ADDR                                                  = 0.0.0.0
 HTTP_PORT                                                  = 80
 ROOT_URL                                                   = REPLACE_SERVER_PROTO://REPLACE_SERVER_NAME