ci: add Gitea Actions CI/CD, branch workflow, and contributor docs

- .gitea/workflows/ci.yml: build + test KisaniCal scheme on a self-hosted
  macOS runner for every PR into main/develop (and pushes to develop).
- .gitea/workflows/release.yml: archive + export IPA on push to main, with
  a commented TestFlight upload placeholder (App Store Connect API key).
- ExportOptions.plist: export template (Team ID K8BLMMR883, app-store method).
- scripts/gitea-setup.sh: idempotent Gitea API setup for develop default
  branch + main branch protection.
- CONTRIBUTING.md: feature/* -> develop -> main workflow and PR gate rules.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

scripts/gitea-setup.sh

@@ -0,0 +1,82 @@
+#!/usr/bin/env bash
+#
+# One-shot Gitea setup for KisaniCal:
+#   1. Creates the `develop` branch on the server (from main) if missing.
+#   2. Sets `develop` as the repo's default branch.
+#   3. Adds branch protection on `main` (require PR + 1 approval + status check,
+#      block direct pushes / force pushes / deletion).
+#
+# USAGE:
+#   export GITEA_TOKEN=xxxxxxxxxxxxxxxxxxxx      # a Gitea access token with repo scope
+#   ./scripts/gitea-setup.sh
+#
+# Create the token in Gitea: click your avatar → Settings → Applications →
+#   "Generate New Token"  (scopes: at least  write:repository ).
+#
+set -euo pipefail
+
+GITEA_URL="http://10.10.1.21:3002"
+OWNER="kutesir"
+REPO="KisaniCal"
+
+# The commit-status context that must pass before merge into main.
+# For Gitea Actions this is the JOB name from ci.yml ("build-and-test").
+# After your first CI run, confirm the exact context string at:
+#   ${GITEA_URL}/${OWNER}/${REPO}/commits  (hover the check) and adjust if needed.
+STATUS_CONTEXT="build-and-test"
+
+: "${GITEA_TOKEN:?Set GITEA_TOKEN env var first (see header).}"
+
+API="${GITEA_URL}/api/v1"
+AUTH=(-H "Authorization: token ${GITEA_TOKEN}" -H "Content-Type: application/json")
+
+echo "==> 1/3  Ensuring 'develop' branch exists on server..."
+if curl -fsS "${AUTH[@]}" "${API}/repos/${OWNER}/${REPO}/branches/develop" >/dev/null 2>&1; then
+  echo "    develop already exists."
+else
+  curl -fsS -X POST "${AUTH[@]}" \
+    "${API}/repos/${OWNER}/${REPO}/branches" \
+    -d '{"new_branch_name":"develop","old_branch_name":"main"}' >/dev/null
+  echo "    created develop from main."
+fi
+
+echo "==> 2/3  Setting default branch to 'develop'..."
+curl -fsS -X PATCH "${AUTH[@]}" \
+  "${API}/repos/${OWNER}/${REPO}" \
+  -d '{"default_branch":"develop"}' >/dev/null
+echo "    default branch = develop."
+
+echo "==> 3/3  Applying branch protection on 'main'..."
+# If a rule already exists this POST returns 409; we then PUT-update it.
+PROTECT_PAYLOAD=$(cat <<JSON
+{
+  "branch_name": "main",
+  "rule_name": "main",
+  "enable_push": false,
+  "enable_push_whitelist": false,
+  "required_approvals": 1,
+  "enable_approvals_whitelist": false,
+  "block_on_rejected_reviews": true,
+  "dismiss_stale_approvals": true,
+  "enable_status_check": true,
+  "status_check_contexts": ["${STATUS_CONTEXT}"],
+  "block_on_outdated_branch": true
+}
+JSON
+)
+
+if curl -fsS -X POST "${AUTH[@]}" \
+     "${API}/repos/${OWNER}/${REPO}/branch_protections" \
+     -d "${PROTECT_PAYLOAD}" >/dev/null 2>&1; then
+  echo "    created protection rule for main."
+else
+  echo "    rule may already exist — updating it..."
+  curl -fsS -X PATCH "${AUTH[@]}" \
+    "${API}/repos/${OWNER}/${REPO}/branch_protections/main" \
+    -d "${PROTECT_PAYLOAD}" >/dev/null
+  echo "    updated protection rule for main."
+fi
+
+echo ""
+echo "Done. Note: Gitea automatically blocks force-pushes and deletion of a"
+echo "protected branch, so 'main' is now safe from both."