feat(webhook): Forgejo package webhook \u2192 ArgoCD image promotion (#54)

Replaces ArgoCD Image Updater with a webhook-driven approach.

When Forgejo fires X-Gitea-Event: package (action: created, type: container):
1. Extract image owner+name+version from payload
2. Look up in static promotion table (10 images \u2192 ArgoCD apps)
3. Fetch digest from Forgejo registry v2 API (Basic auth, REGISTRY_PAT)
4. Read-modify-write ArgoCD Application CR via k8s API (in-cluster SA token)
   - kustomize: JSON Patch /spec/sources[N]/kustomize/images
   - helm:      JSON Patch /spec/source/helm/parameters (runner.image.*)
5. Send Gotify notification with promotion result

Key design:
- Raw http.Client only \u2014 no client-go dependency
- context.Context propagated through all outbound calls
- Retry up to 3x on 409 Conflict (concurrent poimen-toolkit promotions)
- Request ID per invocation for log correlation
- Promotion table covers: api-gw, portfolio, poimen (3 sources), poimen-toolkit (2 images), forgejo-runner-{golang,node,rust}

RBAC: ClusterRole image-promoter (get+patch applications.argoproj.io) bound to api-gateway SA
NetworkPolicy: egress to cicd:3000 (registry) + default:443 (k8s API)
Deployment: REGISTRY_PAT from forgejo-registry-pat secret
13 tests in promoter_test.go, all pass

Closes #54

k8s/rbac.yaml

@@ -0,0 +1,28 @@
+# RBAC for api-gateway image promotion.
+# Grants the api-gateway ServiceAccount get+patch on ArgoCD Applications
+# so it can update kustomize.images / helm.parameters after a container push.
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: image-promoter
+  labels:
+    app: api-gateway
+rules:
+- apiGroups: ["argoproj.io"]
+  resources: ["applications"]
+  verbs: ["get", "patch"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: image-promoter-api-gateway
+  labels:
+    app: api-gateway
+subjects:
+- kind: ServiceAccount
+  name: api-gateway
+  namespace: api
+roleRef:
+  kind: ClusterRole
+  name: image-promoter
+  apiGroup: rbac.authorization.k8s.io