Keep app.ini stable across Gitea restarts

Gitea writes WORK_PATH and a generated [oauth2] JWT_SECRET back into app.ini on start, so every Ansible run rewrote the file and restarted Gitea. Template WORK_PATH and, when gitea_oauth2_jwt_secret is set, the oauth2 JWT secret.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

templates/opt/gitea/home/app.ini.j2

@@ -1,6 +1,8 @@
 APP_NAME = gitea@{{ gitea_ssh_domain }}
 RUN_USER = {{ gitea_usr }}
 RUN_MODE = {{ cloud_stage }}
+# set explicitly, otherwise Gitea writes it back and reformats this file on every start
+WORK_PATH = {{ gitea_data_location }}
 
 [database]
 DB_TYPE  = {{ gitea_dbtype_mapping[gitea_db.type] | default('mysql') }}
@@ -62,6 +64,11 @@ NO_REPLY_ADDRESS                  = noreply.{{ gitea_ssh_domain }}
 ENABLE_OPENID_SIGNIN = false
 ENABLE_OPENID_SIGNUP = false
 
+{% if gitea_oauth2_jwt_secret is defined %}
+[oauth2]
+JWT_SECRET = {{ gitea_oauth2_jwt_secret }}
+
+{% endif %}
 [oauth2_client]
 ENABLE_AUTO_REGISTRATION = true
 UPDATE_AVATAR            = true