security: deploy pod manifests containing credentials with mode 0600

gitea.yaml, immich.yaml, and metabase.yaml embed database passwords in
env vars; per repo policy, rendered files containing secrets must not
be world-readable.

roles/gitea/tasks/main.yml

@@ -101,7 +101,7 @@
     dest: "{{ podman_projects_dir | default('/opt/podman') }}/gitea/gitea.yaml"
     owner: "{{ ansible_user }}"
     group: "{{ ansible_user }}"
-    mode: "0644"
+    mode: "0600"
   notify: Restart gitea
 
 - name: Get home directory for {{ ansible_user }}

roles/immich/tasks/main.yml

@@ -127,7 +127,7 @@
     dest: "{{ podman_projects_dir | default('/opt/podman') }}/immich/immich.yaml"
     owner: "{{ ansible_user }}"
     group: "{{ ansible_user }}"
-    mode: "0644"
+    mode: "0600"
   notify: Restart Immich
 
 - name: Get home directory for {{ ansible_user }}

roles/metabase/tasks/main.yml

@@ -73,7 +73,7 @@
     dest: "{{ podman_projects_dir }}/metabase/metabase.yaml"
     owner: "{{ ansible_user }}"
     group: "{{ ansible_user }}"
-    mode: "0644"
+    mode: "0600"
   notify: Restart Metabase
 
 - name: Get home directory for {{ ansible_user }}