Stop rotating PostgreSQL passwords — services read them from env
vars at startup and CI can't safely restart infrastructure.
Preserve ALL current .env values; only create a fresh Gitea API
token (stateless, no restart needed). This prevents the cascade
of auth failures that was killing the stack on every deploy.