fix(turn-rotation): add hostAliases for private-network Gitea access

Job hung indefinitely on git clone - public-internet reachability to
rohana.axion1337.de from inside pods is currently down (related to
Issue #41's firewall/private-network findings), and the node-level
/etc/hosts workaround only helps containerd's image pulls, not processes
running inside pods (they resolve via CoreDNS + their own /etc/hosts, not
the node's). hostAliases routes this job's git/API traffic over the
private Hetzner network directly - verified working with a real pod.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

apps/production/turn-secret-rotation.yaml

@@ -24,6 +24,13 @@ spec:
             app.kubernetes.io/component: rotation
         spec:
           restartPolicy: OnFailure
+          # Public-internet reachability to the Gitea host has been flaky (see Issue #41);
+          # both servers share a private Hetzner network. hostAliases (unlike the node-level
+          # /etc/hosts fix used for image pulls) is actually honored by in-pod processes.
+          hostAliases:
+            - ip: "10.0.0.3"
+              hostnames:
+                - "rohana.axion1337.de"
           containers:
             - name: rotate
               image: rohana.axion1337.de/sorb/axion-secret-rotation:v1