feat(kafka): complete kafka integration - service deployed and verified

modules/forgejo.nix

@@ -134,10 +134,17 @@
           labels = cfg.runner.labels;
           settings = {
             container = {
-              network = "bridge";
+              network = "host";
             };
           };
         };
       };
+
+      # Fix: Bind mount Podman socket for gitea-runner
+      # With DynamicUser=true, SupplementaryGroups doesn't reliably work.
+      # BindPaths ensures the service can access the socket regardless of group membership.
+      systemd.services.gitea-runner-default = lib.mkIf cfg.runner.enable {
+        serviceConfig.BindPaths = [ "/run/podman/podman.sock" ];
+      };
     };
   }