Secrets & deployment

This repository contained a committed Google service account and a local `.env` file with private keys. Those files were removed from the repository.

How to provide credentials securely in your environment:

Options (pick one):

1) Set `GOOGLE_APPLICATION_CREDENTIALS` to the path of a service account JSON file on the host (do NOT commit the file):

   - Upload the JSON to a secure location on the host (e.g. `/etc/secrets/gitea-sync-sa.json`) and set:

     export GOOGLE_APPLICATION_CREDENTIALS=/etc/secrets/gitea-sync-sa.json

2) Set `GOOGLE_SERVICE_ACCOUNT_JSON` to the full JSON string (base64 encoding recommended):

   - Encode the JSON and provide it as an env var in your process manager or CI/CD secret store:

     export GOOGLE_SERVICE_ACCOUNT_JSON='{"type":...}'

   - For CI/CD you can store it as a secret and map it into the runtime.

3) Legacy: set `GOOGLE_PRIVATE_KEY` and `GOOGLE_SERVICE_ACCOUNT_EMAIL` separately as env vars. This is supported for backward compatibility but less convenient.

Other notes:
- Do NOT commit `.env` or service account files. Add them to project `.gitignore` (done).
- Rotate service account keys immediately if these keys were used publicly.
- Use a secret manager (AWS Secrets Manager, GCP Secret Manager, Vault) in production.

Webhook secret:
- Provide `GITEA_WEBHOOK_SECRET` as an env var in your runtime environment.
- Do NOT commit it to the repository.