[IanCou]

Summary

Prepares People Portal and the dev stack for upgrading git.appdevclub.com from Gitea 1.24.3 to 1.27.3, which fixes the Actions fork-PR approval-gate bypasses (CVE-2026-58424, CVE-2026-71184). Found by running the upgrade end to end on the local dev stack with a hardened act_runner VM.

This must ship before (or with) the prod Gitea upgrade. On 1.27.3, every Gitea webhook delivery to People Portal returned 422: Gitea adds fields to the webhook repository object (branch_count, has_code, allow_merge_update, ...) and tsoa runs with noImplicitAdditionalProperties: throw-on-extras. New team repos would never be provisioned or branch-protected.

Commits

1. Accept new Gitea webhook fields so repos keep provisioning after upgrades. Webhook models now declare only the fields the handlers read and accept the rest (the handlers already re-fetch the repository from the API before acting). Provisioning takes the API's copy of the repository plus the sender. routes.ts regenerated.
2. Run the dev stack on Gitea 1.27.3 with production's planned hardening. DISABLE_HTTP_GIT=false (Actions checkout needs it), ENABLE_BASIC_AUTHENTICATION=false, DISABLE_QUERY_AUTH_TOKEN=true. With Basic passwords refused, bootstrap-gitea.sh's token recovery broke (403); it now uses a short-lived CLI-minted token as the Basic password, sweeps stale and orphaned rotation tokens, saves the replacement before cleanup, revokes the short-lived token via an EXIT trap on failure, and keeps tokens out of argv.
3. Gitea 1.24 → 1.27 upgrade runbook in the wiki (deployment section): config, backup/rollback, release-note checks, People Portal prerequisite, per-org Restricted job tokens, verification checklist. Also bumps the legacy manual Gitea example off 1.21.0.

Test plan

• prettier@3.9.10 --check on webui/server src, nx run-many -t build -p pplserver pplui, nx run pplserver:test-unit (CI's PR checks); full server suite 135/135
• New gitea-webhook-payloads.test.js: 1.27-shaped payloads accepted (both were 422 on the old code); missing required field still rejected; created / first-push-to-main act on the API's repository and do nothing on an id/owner mismatch (faked clients)
• Dev stack upgraded in place from a 1.24.3 volume: migrations 336-342 in one boot, scripts/verify.sh 16/16
• End to end on 1.27.3 with the server running: new org repo private → public with default branch main; first push created the main rule (2 approvals, PeoplePortalTeamOwners allowlists, no force push); no validation errors
• Bootstrap: normal run, recovery with stale token present / absent / orphaned rotation token, and a mid-recovery failure (lookup container stopped) that exits non-zero and leaves no extra token; no token in any script process's argv
• Actions on a hardened runner VM: checkout passes on 1.27.3 (403 on the 1.24.3 baseline); org on Restricted → default token write 403, contents: write 201
• Auth: password over git/API refused, token allowed, ?token= 401
• corpwiki npm run build succeeds
• Prod upgrade itself, following the new runbook (Postgres there; local stack is SQLite)

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has insufficient remaining quota.

[IanCou]

Closing: we're staying on Gitea 1.24.3 instead of upgrading. Checkout was fixed by config alone (DISABLE_HTTP_GIT=false, ENABLE_BASIC_AUTHENTICATION=false, DISABLE_QUERY_AUTH_TOKEN=true), deployed through TechOperationsCDK. The 1.27-specific webhook model change and dev-stack bump aren't needed on 1.24.3.