ci: single Gitea Actions pipeline, uv-based image, scoped docker cleanup

Replace lint/test/docker workflows with ci.yml (gitleaks, lint, test-unit, test-integration, test-mcp, build-and-push, docs-check, security). Rebuild the Dockerfile as a digest-pinned multi-stage uv build running as uid 1000, add .dockerignore, a hardened compose file and a gitleaks config. The integration harness now falls back to /etc/hostname and /proc/self to find its own container.

.dockerignore

@@ -0,0 +1,35 @@
+# Keep the build context small and free of secrets. The Dockerfile only needs
+# pyproject.toml, uv.lock, README.md, LICENSE and src/.
+.git
+.gitea
+.github
+.claude
+.venv
+venv
+env
+
+.env
+.env.*
+!.env.example
+
+tests
+docs
+spec
+scripts
+docker
+docker-compose.yml
+security
+
+__pycache__
+*.py[cod]
+.pytest_cache
+.mypy_cache
+.ruff_cache
+.coverage
+.coverage.*
+htmlcov
+dist
+build
+*.egg-info
+
+*.log