gitea leaves the baseline and becomes an app-store install

It was in both light profiles on the reasoning that it fronts a REMOTE instance and so
needs nothing installed locally. That is true and it was beside the point: a baseline
process appears in the dock and in the Permissions screen whether or not anyone ever
gave it a URL, so a fresh server offered to grant members access to a Gitea that did
not exist. "Is Gitea here" had two answers that could disagree.

Now it is `existing` mode with a URL and a token, like any other remote service, and
the one place that says whether it is here is the install row. No compose template and
no `provisioned` mode: Gitea is always something the owner already runs, and offering to
spin one up would mean owning its migration, backup and upgrade story.

members: 'none' — not because Gitea is single-tenant, it is the most per-user service
in the catalogue, but because there is nothing for the INSTALLER to do. The owner's
connection carries the instance; each member adds their own access token from /gitea and
acts only as themselves upstream. A provisioner would need an admin token and would mint
credentials on their behalf, which is more authority than this needs.

The catalogue test already pinned "the store offers exactly what light leaves out", so
removing it from the profile is what forced the entry to exist. Both light profiles
changed together — the mac one carried the same comment and the same gap.

Permissions on a fresh install is now Files and Plans. Plans stays because it reads the
platform's own shipped markdown from <repo>/plans, not anyone's disk, so it needs
nothing installed and exposes nothing.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

ecosystem.light.config.cjs

@@ -26,16 +26,17 @@ module.exports = defineProfile({
     'officer-agent', // spawns `claude` — chat is dead without it
     'officer-opencode', // the alternative agent
     'officer-pty', // the terminal
-    // Included even though a light host runs no Gitea: this sidecar fronts a REMOTE instance. Its URL
-    // and token live in `service_connections`, set from /gitea, so it needs nothing installed here.
-    // That is what separates it from the sidecars below, which supervise a local daemon or container.
-    // Same reasoning as the mac light profile, which has included it since it was added.
-    'officer-gitea',
   ],
 
   // Excluded by CHOICE rather than by platform limits — every one of these would run on a Linux host.
   // A light install simply is not running the thing behind it.
   excluded: {
+    // Was in the baseline until 2026-08-11, on the reasoning that it fronts a REMOTE instance and so needs
+    // nothing installed locally. True, and beside the point: a baseline process appears in the Permissions
+    // screen and the dock whether or not anyone has given it a URL, so a fresh server offered to grant Gitea
+    // access to an instance that did not exist. It is installable now — `existing` mode, URL and token — which
+    // makes "is Gitea here" one question with one answer instead of two that disagree.
+    'officer-gitea': 'fronts a remote instance; installed from the app store with its URL and token',
     'officer-vnc': 'no desktop to mirror on a light install',
     'officer-email': 'needs the mbsync/IMAP stack the light profile does not install',
     'officer-music': 'the ffprobe indexer works, but a full library index is not a light-install concern',