feat: gitea runners infra, but it is so expancive

infra/gitea-runners/opentofu/README.md

@@ -63,19 +63,25 @@ The default cluster is deliberately fixed-size:
 - cluster name: `gitea-runners`
 - Hetzner location: `fsn1`
 - private network region: `eu-central`
-- control plane: one `cpx21` node in pool `control-plane`
-- workers: three `cpx31` nodes in pool `runner-workers`
+- control plane: one `cpx22` node in pool `control-plane`
+- workers: one `cpx22` node in pool `runner-workers`
 - storage: Hetzner CSI enabled with expected StorageClass `hcloud-volumes`
 - Longhorn: disabled
 - autoscaling/KEDA: not enabled in this stack
 
-The three default workers are sized for the initial five trusted privileged DinD
-jobs. To scale toward ten jobs later, keep autoscaling disabled and either raise
-`worker_count` to `5` or increase `worker_server_type`, then run a fresh
-`tofu plan` and the Task 11 Kubernetes pressure checks before applying.
+The default baseline uses one `cpx22` worker to keep the idle bill low while
+still supporting trusted internal jobs. To scale toward higher concurrency
+later, keep autoscaling disabled and either raise `worker_count` or increase
+`worker_server_type`, then run a fresh `tofu plan` and the Task 11 Kubernetes
+pressure checks before applying.
 
 Required inputs must come from environment or secret injection, for example
 `TF_VAR_hcloud_token`, `TF_VAR_ssh_public_key`, and `TF_VAR_ssh_private_key`.
+Set `TF_VAR_firewall_ssh_source` and `TF_VAR_firewall_kube_api_source` explicitly
+to trusted CIDR ranges before planning; the cluster must not expose SSH or port
+6443 to `0.0.0.0/0`.
+If the public key is already registered in Hetzner, set
+`TF_VAR_hcloud_ssh_key_id` to reuse it instead of creating a duplicate key.
 Do not commit `.tfvars` files. kube-hetzner v2.19.3 writes the generated
 kubeconfig to `./<cluster_name>_kubeconfig.yaml` when `create_kubeconfig` is
 enabled; this path is ignored as operational secret material.