feat(nixos): cut over Gitea to Pikachu

configs/nixos/modules/services/gitea.nix

@@ -57,15 +57,8 @@ in
             SSH_LISTEN_PORT = 2222;
             REVERSE_PROXY_TRUSTED_PROXIES = "${cfg.reverseProxyAddress}/32";
           };
-          migrations.ALLOWED_HOST_LIST = lib.concatStringsSep "," [
-            "git.alexion.dev:80"
-            "git.alexion.dev:443"
-            "10.23.20.109/32:80"
-            "10.23.20.109/32:443"
-          ];
           service.DISABLE_REGISTRATION = true;
-          # Direct bootstrap access uses HTTP until the public HTTPS route moves.
-          session.COOKIE_SECURE = false;
+          session.COOKIE_SECURE = true;
         };
       };
     })