docs(orientation): gitea internal-route gotcha (fleet hosts -> 10.250.50.70:222)

Fleet/colo hosts must reach gitea over the internal route (ana-docker
container git-SSH at 10.250.50.70:222), not the public gitea.phasefinal.com:22
which fail2bans the host's egress IP and silently wedges webhook auto-deploys.
Bit irv-ml1's arbo deploy 2026-06-13.

docs/orientation.md

@@ -164,6 +164,25 @@ These caught us once; don't let them catch you twice.
 - **irv-ml1 was `ana-ml1`** before a physical move; OS hostname still
   says `ana-ml1` pending an explicit rename. Doesn't affect services.
 
+### Git / gitea
+
+- **Colo/fleet hosts must reach gitea over the INTERNAL route, not the
+  public IP.** `gitea.phasefinal.com` resolves to the **public** IP
+  `38.120.12.44` (ana-srv1); gitea itself is a container on **ana-docker**
+  with git-SSH at **`10.250.50.70:222`** (`222→22`) and HTTP at `:3000`.
+  A fleet host that egresses to the public `:22` gets its egress IP
+  **fail2ban-banned** after any retrying git/deploy loop, which silently
+  wedges automation — e.g. a gitea-webhook auto-deploy whose `git fetch`
+  then times out under `set -euo pipefail` and never reaches the `reset`.
+  Point each host's gitea ssh alias at `HostName 10.250.50.70` /
+  `Port 222` with the repo deploy key; the internal route is ban-immune
+  and treats the cause. Bit irv-ml1's arbo deploy on 2026-06-13 (the
+  `gitea-arbo` alias pointed at the public host → fetch timeout → the
+  v0.11.7 frontend wouldn't serve until the alias was repointed internal).
+- **`:22` on `10.250.50.70` is ana-docker's HOST sshd, not gitea.** A
+  gitea deploy key there returns `Permission denied (publickey)` — gitea's
+  git-SSH is the container port `:222`. (HTTP/clone-over-HTTPS is `:3000`.)
+
 ### Workflow
 
 - **Terminal word-wrap breaks long pasted commands.** Never embed a