ci: single Gitea Actions pipeline, uv-based image, scoped docker cleanup

Replace lint/test/docker workflows with ci.yml (gitleaks, lint, test-unit, test-integration, test-mcp, build-and-push, docs-check, security). Rebuild the Dockerfile as a digest-pinned multi-stage uv build running as uid 1000, add .dockerignore, a hardened compose file and a gitleaks config. The integration harness now falls back to /etc/hostname and /proc/self to find its own container.

.gitleaks.toml

@@ -0,0 +1,37 @@
+# Gitleaks configuration. Extends the default ruleset; only the findings below
+# are allowlisted. Every one of them was reviewed and is a fake or a placeholder
+# (documentation examples, test fixtures, and a variable name that matched the
+# generic key rule). Real credential rules (cloud keys, private keys, provider
+# token formats) stay active everywhere.
+title = "AegisGitea-MCP gitleaks config"
+
+[extend]
+useDefault = true
+
+# Fake tokens in tests and placeholder values in docs. Only the two noisy
+# generic rules are silenced, and only in these directories.
+[[allowlists]]
+description = "fake fixtures in tests and placeholder examples in docs"
+targetRules = ["generic-api-key", "curl-auth-header"]
+paths = [
+  '''^tests/''',
+  '''^docs/''',
+]
+
+# Legacy top-level guides that no longer exist in the tree (they live only in
+# history). They contained placeholder keys such as YOUR_API_KEY and
+# a1b2c3d4e5f6....
+[[allowlists]]
+description = "removed legacy docs with placeholder keys"
+targetRules = ["generic-api-key", "curl-auth-header"]
+paths = [
+  '''^(AUTH_SETUP|AUTHENTICATION_IMPLEMENTATION_SUMMARY|CHATGPT_SETUP|DEPLOYMENT|KEY_ROTATION|TESTING)\.md$''',
+]
+
+# Removed module: a cache-size constant name matched the generic key rule.
+[[allowlists]]
+description = "false positive in a removed source file"
+targetRules = ["generic-api-key"]
+paths = [
+  '''^src/aegis_gitea_mcp/server\.py$''',
+]