Add options for built-in SSH server and HTTP bind address

- gitea_ssh_builtin: use Gitea's built-in SSH server (default false)
- gitea_ssh_listen_port: SSH listen port, falls back to ssh_port
- gitea_http_addr: optional HTTP bind address
- grant CAP_NET_BIND_SERVICE when the built-in server uses a port < 1024

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

templates/etc/systemd/system/gitea.service.j2

@@ -20,6 +20,11 @@ Group={{ gitea_grp }}
 WorkingDirectory={{ gitea_data_location }}
 ExecStart={{ gitea_link }}/gitea web --config {{ gitea_home }}/app.ini
 Restart=always
+{% if gitea_ssh_builtin | default(false) | bool and (gitea_ssh_listen_port | default(22) | int) < 1024 %}
+# built-in SSH server binds a privileged port
+AmbientCapabilities=CAP_NET_BIND_SERVICE
+CapabilityBoundingSet=CAP_NET_BIND_SERVICE
+{% endif %}
 Environment=USER={{ gitea_usr }} HOME={{ gitea_home }} GITEA_WORK_DIR={{ gitea_data_location }}
 #Environment=PATH=/path/to/git/bin:/bin:/sbin:/usr/bin:/usr/sbin