fix(forgejo): restart the pod when the database password changes

GITEA__DATABASE_PASSWD comes from forgejo-db-app, which the CNPG Cluster CR owns and
generates. There is no bootstrap secret, so nothing but cloudnative-pg knows that
password. The Deployment reads it into the environment at start.

So a regenerated password leaves Forgejo authenticating with a value the database no
longer accepts: the pod stays Ready, every query fails, and the symptom looks like a
network problem rather than a credential problem. The cnpg.io/reload label on the
Secret is only a hint; this annotation is what makes Reloader act on it.

k8s/bootstrap/phase3-forgejo/forgejo-values.yaml

@@ -102,6 +102,20 @@ persistence:
   accessModes:
     - ReadWriteOnce
 
+# Pod annotations.
+#
+# GITEA__DATABASE_PASSWD comes from forgejo-db-app, a Secret the CNPG Cluster CR owns
+# and generates: cloudnative-pg created it, and there is no bootstrap secret, so
+# nothing else knows that password. The Deployment reads it into the environment at
+# start, so a regenerated password would leave Forgejo authenticating with a value the
+# database no longer accepts — the pod stays up and every query fails.
+#
+# The cnpg.io/reload label on the Secret is only a hint. This annotation is what makes
+# Stakater Reloader restart the pod when the Secret changes, so the environment is
+# refreshed instead of silently stale.
+podAnnotations:
+  reloader.stakater.com/auto: "true"
+
 # Ingress
 ingress:
   enabled: true