Configure Gitea Actions for Helm chart CI and release

- Replace GitHub chart-releaser with Gitea-compatible workflow
- Lint job: helm lint, template validation on push to main/master
- Release job: package and publish to Gitea releases on tag push (v*)
- Use gitea-release-action for creating releases
- Support both main and master branches

Co-authored-by: Cursor <cursoragent@cursor.com>

README.md

@@ -85,11 +85,11 @@ make verify
 
 Verification checklist:
 
-| Component | Check |
-|-----------|-------|
-| **FleetDM** | Pods running; ingress `fleet.localhost` serves Fleet UI |
-| **MySQL** | `fleetdm-stack-mysql` service; Fleet connects and runs migrations |
-| **Redis** | `fleetdm-stack-redis-master` service; Fleet uses it for cache |
+| Component   | Check                                                             |
+| ----------- | ----------------------------------------------------------------- |
+| **FleetDM** | Pods running; ingress `fleet.localhost` serves Fleet UI           |
+| **MySQL**   | `fleetdm-stack-mysql` service; Fleet connects and runs migrations |
+| **Redis**   | `fleetdm-stack-redis-master` service; Fleet uses it for cache     |
 
 ### Manual verification
 
@@ -109,11 +109,11 @@ kubectl logs -n fleetdm -l app=fleet -f
 
 ## Configuration
 
-| Value | Description | Default |
-|-------|-------------|---------|
-| `mysql.auth.password` | MySQL password | `fleetdm-local-dev` |
-| `fleet.replicas` | Fleet server replicas | `1` |
-| `fleet.hostName` | Ingress host | `fleet.localhost` |
+| Value                 | Description           | Default             |
+| --------------------- | --------------------- | ------------------- |
+| `mysql.auth.password` | MySQL password        | `fleetdm-local-dev` |
+| `fleet.replicas`      | Fleet server replicas | `1`                 |
+| `fleet.hostName`      | Ingress host          | `fleet.localhost`   |
 
 Override via `--set` or custom values file:
 
@@ -123,6 +123,10 @@ helm upgrade --install fleetdm-stack fleetdm-stack/ \
   --set mysql.auth.password=SECURE_PASSWORD
 ```
 
+## TLS certificates
+
+For local development, the chart includes self-signed TLS certificates (generated on first `make install`). Production deployments should use cert-manager or provide proper certificates via `fleet.secretName`.
+
 ## FleetDM agent reachability
 
 The chart exposes Fleet via ingress so:
@@ -146,8 +150,9 @@ tech-task/
 │   ├── Chart.yaml
 │   ├── Chart.lock
 │   ├── values.yaml
+│   ├── certs/              # TLS certs (generated by make install)
 │   └── charts/             # Dependencies (run make deps)
-├── Makefile
+├── Makefile                # cluster, install, uninstall, verify, clean
 ├── README.md
 ├── .github/workflows/      # CI for Helm chart releases
 └── docs/                   # Theoretical part
@@ -161,7 +166,3 @@ The architectural design document for "Company Inc." is in `docs/`:
 
 - [Architecture Design Document](docs/architecture-design-company-inc.md) — 1–2 page design (convert to PDF for submission)
 - [High-Level Diagram Reference](docs/architecture-hld.md) — Mermaid source and draw.io guide for HLD
-
-## License
-
-MIT