- Replace docker exec gitea with GiteaClient.change_admin_password()
API call — no Docker socket needed for Gitea (#110)
- Use psql -v variable binding for passwords instead of f-string
interpolation — passwords never appear in SQL text (#113)
- Wrap each backend in try/except with 3x retry + exponential
backoff — partial failure still writes .env (#111)
- Add provision_woodpecker() to sync rotated creds (gitea_token,
registry_pass, s3 keys) to Woodpecker repo secrets via API (#112)
- Return ProvisionResult dataclass with per-backend status
fix#109fix#110fix#111fix#112fix#113
6bba64ef16
