- gitea: use rootless image tag (28.2.0-rootless) since deployment runs as non-root UID 1000; standard tag uses s6-overlay requiring root - openproject: add secretKeyBase secret and SECRET_KEY_BASE env var to web, worker, and seeder; v17 enforces non-default SECRET_KEY_BASE