split forgejo-runner into own service file for staged deployment

- Extract forgejo-runner config from forgejo.nix into forgejo-runner.nix
- Move forgejo-runner to stage 2 (requires running Forgejo for token)
- Remove all stage-2 secrets from sops.nix (each service file owns its secrets)
- Update first-install docs with corrected staged deployment flow
- Fixes deployment failure caused by runner crashing with placeholder token

hosts/cryodev-main/services/forgejo.nix

@@ -8,7 +8,6 @@
 {
   imports = [
     outputs.nixosModules.forgejo
-    outputs.nixosModules.forgejo-runner
   ];
 
   services.forgejo = {
@@ -32,17 +31,6 @@
     };
   };
 
-  services.forgejo-runner = {
-    enable = true;
-    url = "https://${constants.services.forgejo.fqdn}";
-    tokenFile = config.sops.secrets."forgejo-runner/token".path;
-  };
-
-  sops.secrets."forgejo-runner/token" = {
-    # gitea-runner user is created by gitea-actions-runner service
-    mode = "0400";
-  };
-
   services.nginx.virtualHosts."${constants.services.forgejo.fqdn}" = {
     forceSSL = true;
     enableACME = true;