fix(console): comprehensive TUI rendering fixes

- Fix Enter key detection: handle multiple Enter key formats (\n, \r, \r\n)
- Reduce flickering: lower render frequency from 60 FPS to 30 FPS
- Fix menu bar visibility: re-render menu bar after content to prevent overwriting
- Fix content positioning: explicit line positioning for categories and commands
- Fix line shifting: clear lines before writing, control newlines manually
- Limit visible items: prevent overflow with maxVisibleCategories/Commands
- Improve CPU usage: increase sleep interval when no events processed

This fixes:
- Enter key not working for selection
- Strong flickering of the application
- Menu bar not visible or being overwritten
- Top half of selection list not displayed
- Lines being shifted/misaligned

deployment/ansible/templates/gitea-app.ini.j2

@@ -23,6 +23,10 @@ DOMAIN = {{ gitea_domain }}
 HTTP_ADDR = 0.0.0.0
 HTTP_PORT = 3000
 ROOT_URL = https://{{ gitea_domain }}/
+# LOCAL_ROOT_URL for internal access (Runner/Webhooks)
+LOCAL_ROOT_URL = http://gitea:3000/
+# Trust Traefik proxy (Docker network: 172.18.0.0/16)
+PROXY_TRUSTED_PROXIES = 172.18.0.0/16,::1,127.0.0.1
 DISABLE_SSH = false
 START_SSH_SERVER = false
 SSH_DOMAIN = {{ gitea_domain }}
@@ -68,7 +72,11 @@ HOST = redis://:{{ redis_password }}@redis:6379/0?pool_size=100&idle_timeout=180
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 [session]
 PROVIDER = redis
-PROVIDER_CONFIG = network=tcp,addr=redis:6379,password={{ redis_password }},db=0,pool_size=100,idle_timeout=180
+# PROVIDER_CONFIG must be a Redis connection string (as per Gitea documentation)
+# Format: redis://:password@host:port/db?pool_size=100&idle_timeout=180s
+# Using same format as cache HOST and queue CONN_STR for consistency
+PROVIDER_CONFIG = redis://:{{ redis_password }}@redis:6379/0?pool_size=100&idle_timeout=180s
+SAME_SITE = lax
 
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 ;; Queue Configuration (Redis)
@@ -82,6 +90,8 @@ CONN_STR = redis://:{{ redis_password }}@redis:6379/0
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 [security]
 INSTALL_LOCK = true
+# Cookie security (only if ROOT_URL is https)
+COOKIE_SECURE = true
 
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 ;; Service Configuration