falco: tune gitea-web proxy noise, bound log growth

nginx-proxy's routine reverse-proxied traffic to gitea:3000 trips the
"Redirect stdout/stdin to network connection" rule every 5-15 min via
the same dup3 mechanic as the already-excluded sshd case - not a new
attack pattern, just proxied web traffic volume. Scoped to gitea's own
fixed internal port so a redirect on any other port from this
previously-compromised container still alerts.

Also caps falco's own json-file log at 50MB x5 files - it had grown
to 1.1GB unbounded (mostly 15s-interval metrics snapshots), which was
making `docker logs falco` unreliable for the exact triage step its
own alert text points admins to.

Claude-Session: https://claude.ai/code/session_01HZQK6jHmdTpFjFZM8FUnqA

falco/docker-compose.yaml

@@ -10,6 +10,11 @@ services:
     image: falcosecurity/falco:0.44.1
     container_name: falco
     restart: always
+    logging:
+      driver: json-file
+      options:
+        max-size: "50m"
+        max-file: "5"
     cap_drop:
       - all
     cap_add: