fix: lock HK Gitea bootstrap

servers/bwh-hk-cmi/gitea/README.md

@@ -10,7 +10,9 @@ Gitea target on the `bwh-hk-cmi` Arcane Environment.
 
 The initial target deliberately uses Gitea `1.25.1`, matching the source on
 Arcane Local Docker. Keep the source online and do not initialize unrelated
-production data before the planned dump/restore cutover.
+production data before the planned dump/restore cutover. The target uses
+SQLite with `INSTALL_LOCK` enabled and registration disabled so the public
+endpoint cannot be claimed while it is waiting for the source restore.
 
 The Gitea data directory is not stored in Git. Back it up before upgrades and
 before every migration attempt. Repository credentials, session secrets, and

servers/bwh-hk-cmi/gitea/compose.yaml

@@ -12,6 +12,10 @@ services:
       GITEA__server__SSH_PORT: "222"
       GITEA__server__SSH_LISTEN_PORT: "22"
       GITEA__server__LFS_START_SERVER: "true"
+      GITEA__database__DB_TYPE: sqlite3
+      GITEA__database__PATH: /data/gitea/gitea.db
+      GITEA__security__INSTALL_LOCK: "true"
+      GITEA__service__DISABLE_REGISTRATION: "true"
     ports:
       - "222:22"
     volumes: