actions-runner: add Forgejo runner to nix-cache02 with Vault token

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

terraform/vault/secrets.tf

@@ -145,6 +145,12 @@ locals {
       password_length = 64
     }
 
+    # Forgejo runner token for nix-cache02
+    "hosts/nix-cache02/forgejo-runner-token" = {
+      auto_generate = false
+      data          = { token = var.forgejo_runner_token }
+    }
+
     # Loki push authentication (used by Promtail on all hosts)
     "shared/loki/push-auth" = {
       auto_generate   = true

terraform/vault/variables.tf

@@ -109,3 +109,10 @@ variable "sonarr_api_key" {
   sensitive   = true
 }
 
+variable "forgejo_runner_token" {
+  description = "Forgejo Actions runner token for nix-cache02"
+  type        = string
+  default     = "PLACEHOLDER"
+  sensitive   = true
+}
+