Enhance Helm chart with ServiceAccount support and configurable ports

- Updated Chart.yaml to version 0.2.0 and added annotations for changes.
- Modified release-chart.yaml to trigger releases via Gitea and handle pre-releases.
- Introduced ServiceAccount configuration in values.yaml and related templates.
- Adjusted internal container ports to prevent conflicts between nginx and aptly.
- Updated README.md and NOTES.txt to reflect new configurations and usage instructions.

charts/aptly/README.md

@@ -311,6 +311,15 @@ plain, supported operation.
 | `persistence.size` | `20Gi` | immutable once installed unless using `existingClaim` |
 | `persistence.annotations` | `{}` | |
 
+### ServiceAccount
+
+| Key | Default | Description |
+|---|---|---|
+| `serviceAccount.create` | `true` | creates a dedicated `ServiceAccount` for this release |
+| `serviceAccount.name` | `""` | `create: true` → defaults to the release's fullname; `create: false` → set this to bind an existing `ServiceAccount`, or leave `""` to use the namespace's `default` one |
+| `serviceAccount.annotations` | `{}` | e.g. for IRSA/Workload Identity |
+| `serviceAccount.automountServiceAccountToken` | `true` | |
+
 ### Workload
 
 | Key | Default | Description |
@@ -330,8 +339,11 @@ plain, supported operation.
 | Key | Default | Description |
 |---|---|---|
 | `service.type` | `ClusterIP` | |
-| `service.port` | `8080` | |
+| `service.port` | `8080` | external port — unaffected by `ports.*` below, which are internal-only |
 | `service.annotations` | `{}` | |
+| `ports.aptly` | `8080` | container port aptly itself listens on (loopback-only unless `proxy.enabled: false`) |
+| `ports.nginx` | `8081` | container port nginx listens on for repo + API traffic; must differ from `ports.aptly` — they're two containers sharing one pod network namespace, and a clash makes nginx fail to start with "address already in use" |
+| `ports.metrics` | `9090` | container port nginx listens on for the `/api/metrics` passthrough, when `metrics.service.enabled` |
 | `ingress.enabled` | `false` | |
 | `ingress.mode` | `single` | `single` \| `split` — see [docs/security.md](https://git.morlana.online/f.weber/aptly-containerized/src/branch/main/docs/security.md) |
 | `ingress.className` | `""` | |