fix(forgejo): disable self-registration

GET /user/sign_up returned 200 — anyone reaching forgejo.riotpiao.com
could create an account. Add [service] DISABLE_REGISTRATION: true.

Admin-created accounts (UI/API) are unaffected.

k8s/bootstrap/phase3-forgejo/forgejo-values.yaml

@@ -46,6 +46,12 @@ gitea:
       SSH_PORT: 2222
       SSH_LISTEN_PORT: 2222
 
+    # Self-signup was open (GET /user/sign_up returned 200), so anyone reaching
+    # forgejo.riotpiao.com could create an account. Accounts are provisioned by
+    # the admin only; admin create-user via UI/API is unaffected by this flag.
+    service:
+      DISABLE_REGISTRATION: true
+
     database:
       DB_TYPE: postgres
       HOST: forgejo-db-rw.cicd.svc.cluster.local:5432