Templates are now stored in provisioning/cloud-init/ (synced from Gitea
bojemoi-configs via SSH) and mounted read-only into the orchestrator container
at /app/cloud-init.
Add LocalTemplateClient (mirrors GiteaClient interface, reads from disk)
Add TEMPLATES_DIR setting in config.py (default /app/cloud-init)
Swap all template calls in main.py from gitea_client → template_client
CloudInitGenerator now receives template_client instead of gitea_client
Add bind-mount in stack/01-service-hl.yml: provisioning/cloud-init → /app/cloud-init:ro
Gitea client retained only for health-check ping
Fixes: VM deploys silently failing when Gitea TLS cert expires.