Move Gitea login from Authentik to Pocket ID

The OAuth2 source in Gitea's database was renamed to PocketID and pointed
at Pocket ID with 'gitea admin auth update-oauth', and the existing
user's external login was remapped to the Pocket ID user. Here the
container now resolves the Pocket ID host instead of Authentik; the
runner never needed the login host. Credentials are in vault_gitea.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

roles/docker/templates/gitea-compose.yml.j2

@@ -23,7 +23,7 @@ services:
     ports:
       - 222:22
     extra_hosts:
-      - '{{ subdomains.auth }}:{{ docker.hairpin_ip }}'
+      - '{{ subdomains.pocketid }}:{{ docker.hairpin_ip }}'
       - '{{ subdomains.git }}:{{ docker.hairpin_ip }}'
 {% if lava_reserved | default(false) | bool %}
     networks:
@@ -42,7 +42,6 @@ services:
       - GITEA_RUNNER_NAME=runner_1
       - GITEA_RUNNER_LABELS=docker
     extra_hosts:
-      - '{{ subdomains.auth }}:{{ docker.hairpin_ip }}'
       - '{{ subdomains.git }}:{{ docker.hairpin_ip }}'
     labels:
       mag37.dockcheck.update: true