split forgejo-runner into own service file for staged deployment

- Extract forgejo-runner config from forgejo.nix into forgejo-runner.nix
- Move forgejo-runner to stage 2 (requires running Forgejo for token)
- Remove all stage-2 secrets from sops.nix (each service file owns its secrets)
- Update first-install docs with corrected staged deployment flow
- Fixes deployment failure caused by runner crashing with placeholder token

hosts/cryodev-main/services/default.nix

@@ -1,13 +1,17 @@
 {
   imports = [
+    # Stufe 1: Services ohne externe Abhaengigkeiten
     ./forgejo.nix
-    ./headplane.nix
     ./headscale.nix
     ./mailserver.nix
     ./netdata.nix
     ./nginx.nix
     ./openssh.nix
     ./sops.nix
-    ./tailscale.nix
+
+    # Stufe 2: Erst aktivieren wenn Headscale/Forgejo laufen und echte Secrets existieren
+    # ./forgejo-runner.nix  # braucht: forgejo-runner/token (Forgejo)
+    # ./headplane.nix       # braucht: headplane/agent_pre_authkey (Headscale)
+    # ./tailscale.nix       # braucht: tailscale/auth-key (Headscale)
   ];
 }