Fix gitea.sh: open the SSH clone port in UFW

install_gitea() scanned WEB_PORT/SSH_PORT and published both in
docker-compose.yml but never opened either in UFW. With UFW active,
a `git clone ssh://...` against the SSH port silently drops instead
of getting connection-refused, which just hangs forever with no
error — the exact symptom reported.

The web port can be safely left off the public rule when Caddy fronts
it locally (scoped to caddy_net instead, matching every other service
here), but SSH can't be proxied through Caddy at all, so it always
gets a direct ufw allow now.

services/gitea.sh

@@ -529,6 +529,8 @@ install_gitea() {
     if [ "$DRY_RUN" = true ]; then
         echo "[DRY-RUN] Would create $DIR with docker-compose.yml (gitea/gitea:latest)"
         echo "[DRY-RUN] Would scan for free host ports (web + SSH) to avoid collisions"
+        echo "[DRY-RUN] Would open the SSH clone port in UFW (web port too, or scoped to caddy_net"
+        echo "[DRY-RUN]   if Caddy ends up fronting it locally)"
         echo "[DRY-RUN] Would prompt for a Gitea admin username/password, then create that account"
         echo "[DRY-RUN]   and an API token once the container is ready (no manual web wizard)"
         echo "[DRY-RUN] Would prompt for a GitHub token and copy in gitea-github-sync.sh"
@@ -738,6 +740,25 @@ ENV
     # replacement requiring Caddy involvement. ─────────────────────────────
     configure_caddy_for_service "Gitea" "host.docker.internal:${WEB_PORT}" "git"
 
+    # ── Firewall ─────────────────────────────────────────────────────────────
+    # SSH clone (SSH_PORT->22) is a different protocol than the web UI — Caddy
+    # can't front it no matter what CADDY_SERVICE_MODE came back as, so it
+    # always needs its own direct rule or `git clone ssh://...` hangs forever
+    # (a dropped SYN with UFW active, not a fast connection-refused).
+    if command -v ufw &>/dev/null; then
+        if [[ "$CADDY_SERVICE_CONFIGURED" == true && "$CADDY_SERVICE_MODE" == "local" ]]; then
+            ufw delete allow "${WEB_PORT}/tcp" 2>/dev/null || true
+            ufw_allow_from_caddy_net "${WEB_PORT}"
+        else
+            ufw allow "${WEB_PORT}/tcp" comment "Gitea web UI" >/dev/null 2>&1 || true
+        fi
+        ufw allow "${SSH_PORT}/tcp" comment "Gitea SSH clone" >/dev/null 2>&1 || true
+        ensure_ufw_enabled
+        log_success "UFW: opened SSH clone port ${SSH_PORT}/tcp"
+    else
+        log_warning "ufw not installed — if you use a firewall, open TCP ${SSH_PORT} for SSH clones."
+    fi
+
     _gitea_offer_authelia_sso "$DIR"
     _gitea_offer_reverse_proxy_auth "$DIR"
     _gitea_offer_actions_runner "$DIR"