Enhance Helm chart with ServiceAccount support and configurable ports

- Updated Chart.yaml to version 0.2.0 and added annotations for changes.
- Modified release-chart.yaml to trigger releases via Gitea and handle pre-releases.
- Introduced ServiceAccount configuration in values.yaml and related templates.
- Adjusted internal container ports to prevent conflicts between nginx and aptly.
- Updated README.md and NOTES.txt to reflect new configurations and usage instructions.

charts/aptly/values.yaml

@@ -176,6 +176,16 @@ proxy:
   readTimeout: "3600s"
   publishEndpointName: public
 
+# Container ports inside the pod. aptly and nginx are two containers sharing
+# one pod network namespace — they MUST NOT use the same port (nginx would
+# fail to start with "address already in use"). These are internal-only;
+# external access is still controlled by service.port / metrics.service.port,
+# which stay decoupled from these via named ports (targetPort: http/metrics).
+ports:
+  aptly: 8080    # aptly's own listener (loopback-only, or 0.0.0.0 when proxy.enabled=false)
+  nginx: 8081    # nginx's main (repo + API) listener
+  metrics: 9090  # nginx's /api/metrics passthrough listener, when metrics.service.enabled
+
 persistence:
   enabled: true
   existingClaim: ""    # set this in production — see docs/operations.md
@@ -184,6 +194,17 @@ persistence:
   size: 20Gi
   annotations: {}
 
+serviceAccount:
+  # Own ServiceAccount per release, so RBAC (if you grant any) is scoped to
+  # this instance rather than the namespace's shared "default" identity.
+  create: true
+  # "" -> aptly.fullname (this release's name) when create=true. When
+  # create=false, set this to bind to a ServiceAccount you already manage;
+  # leave "" to fall back to the namespace's "default" ServiceAccount.
+  name: ""
+  annotations: {}
+  automountServiceAccountToken: true
+
 workload:
   updateStrategy:
     type: RollingUpdate   # safe here: a StatefulSet with replicas=1 always