ci: publish fpr-core/fpr-netty/fpr-bench to the Gitea Maven registry

maven.relism.dev is down, and Flash5 depends on fpr-core to build. Mirrors
Flash5's own .gitea/workflows/publish-maven.yml exactly: on push to master,
stamp every module with a commit-scoped version (1.1.0-<short-sha>, since
Gitea's Maven registry refuses to re-publish an existing name+version) and
deploy to Relism's Gitea package registry with a write:package PAT (Gitea's
own job token can't publish to package registries at all).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

.gitea/maven-settings.xml

@@ -0,0 +1,24 @@
+<settings xmlns="http://maven.apache.org/SETTINGS/1.0.0"
+          xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+          xsi:schemaLocation="http://maven.apache.org/SETTINGS/1.0.0 http://maven.apache.org/xsd/settings-1.0.0.xsd">
+    <!--
+      Used only by .gitea/workflows/publish-maven.yml (mvn -s .gitea/maven-settings.xml deploy).
+      Not used for local builds. PACKAGES_TOKEN is a real personal access token (write:package
+      scope) on the Relism account, read from the env var the workflow exports — never written
+      to disk. Deliberately not Gitea's own per-job GITEA_TOKEN: that token can't publish to
+      any package registry at all, a known unimplemented limitation
+      (https://github.com/go-gitea/gitea/issues/23642) — same finding already confirmed against
+      this same Gitea instance for Flash5's identical workflow.
+
+      Basic auth (username/password): the <httpHeaders> form Gitea's own docs show for this is
+      honored by Maven's resolver (used for reading <repositories>) but not reliably by the
+      wagon-http provider maven-deploy-plugin actually uploads through.
+    -->
+    <servers>
+        <server>
+            <id>gitea</id>
+            <username>Relism</username>
+            <password>${env.PACKAGES_TOKEN}</password>
+        </server>
+    </servers>
+</settings>