Filling out forms to get CI runners means no serious users will be attracted.

I think this will have opposite effect. Only serious users will be willing to fill out forms and casual users will be put off by the bureaucracy. I agree that it is a downside though. In a perfect world, there would be no forms to fill in.

The problem with CI is that the internet is full of not-nice people who will use free compute to mine crypto. Gitlab had problems with this abuse and requires credit card details.

Its not the solution that you are looking for but Woodpecker runs well on k8s and directly supports Forgejo. I use them together on k8s and I am happy enough not have tried runners.

I do this for sites where I don't care at all about security. One minor tip, that will protect against automated attacks if the password is cracked, is to add part of the website name into the password (e.g "mystrongp4ss!lemworld") .

A human could easily crack it, but automated systems that replay the password on different sites would probably not bother to calculate the pattern.

I also use KeepassXC and Synthing together and I am very happy with this combination.

One tip that I have, if you are worried about the security of the database file being shared, is to get 2 Yubikeys and use these, along with a strong passphrase, to protect the database file.