fix(forgejo): the chart key is gitea.podAnnotations, not podAnnotations

The gitea chart reads pod annotations from gitea.podAnnotations (values.yaml line 583).
A top-level key is silently ignored, so the previous commit changed nothing — the
Deployment came back without the annotation and Reloader still had no trigger.

k8s/bootstrap/phase3-forgejo/forgejo-values.yaml

@@ -34,6 +34,8 @@ service:
       lbipam.cilium.io/ips: "192.168.1.161"
 
 gitea:
+  podAnnotations:
+    reloader.stakater.com/auto: "true"
   admin:
     existingSecret: forgejo-admin
 
@@ -102,20 +104,6 @@ persistence:
   accessModes:
     - ReadWriteOnce
 
-# Pod annotations.
-#
-# GITEA__DATABASE_PASSWD comes from forgejo-db-app, a Secret the CNPG Cluster CR owns
-# and generates: cloudnative-pg created it, and there is no bootstrap secret, so
-# nothing else knows that password. The Deployment reads it into the environment at
-# start, so a regenerated password would leave Forgejo authenticating with a value the
-# database no longer accepts — the pod stays up and every query fails.
-#
-# The cnpg.io/reload label on the Secret is only a hint. This annotation is what makes
-# Stakater Reloader restart the pod when the Secret changes, so the environment is
-# refreshed instead of silently stale.
-podAnnotations:
-  reloader.stakater.com/auto: "true"
-
 # Ingress
 ingress:
   enabled: true