Document Gitea Arch DB-signing key import for [tanin]

The Gitea Arch registry signs the repo DB with its own key
(63F0415879323F6BFE0FBFB2B6FDF356206AF4F6); import it via
.../arch/repository.key + pacman-key --lsign-key before -Sy.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

distro/camel.toml

@@ -45,7 +45,8 @@ repo_name = "tanin"
 status    = "LIVE — hosted on the Gitea Arch registry, 9 packages, public, pacman-usable"
 server    = "https://git.openbureau.ch/api/packages/karim/arch/tanin/$arch"
 code_host = "https://git.openbureau.ch/karim/taninux"   # PKGBUILD source clones
-siglevel  = "Optional TrustAll"     # TODO: tighten to "Required" + ship the key
+siglevel  = "Optional TrustAll"     # works once Gitea's DB-signing key is imported
+db_key    = "Gitea signs the repo DB with 63F0415879323F6BFE0FBFB2B6FDF356206AF4F6; import via .../arch/repository.key + pacman-key --lsign-key. ISO/Calamares must import it too."
 publish   = "packaging/publish-tanin-repo.sh (needs a write:package token); Gitea builds the DB server-side"
 vanity    = "taninux.kgva.ch can reverse-proxy / front this later"