ci: single Gitea Actions pipeline, uv-based image, scoped docker cleanup

Replace lint/test/docker workflows with ci.yml (gitleaks, lint, test-unit, test-integration, test-mcp, build-and-push, docs-check, security). Rebuild the Dockerfile as a digest-pinned multi-stage uv build running as uid 1000, add .dockerignore, a hardened compose file and a gitleaks config. The integration harness now falls back to /etc/hostname and /proc/self to find its own container.

scripts/ci/pip_audit.sh

@@ -0,0 +1,25 @@
+#!/usr/bin/env bash
+# Audit the locked dependency set with pip-audit.
+#
+# Ignored advisories (documented waivers, see docs/security.md) are read from
+# security/pip-audit-ignore.txt: one advisory id per line, '#' starts a comment.
+set -euo pipefail
+
+ignore_file="security/pip-audit-ignore.txt"
+req="$(mktemp)"
+trap 'rm -f "${req}"' EXIT
+
+uv export --locked --no-hashes --no-emit-project --format requirements-txt > "${req}"
+
+args=(-r "${req}" --strict --no-deps --disable-pip)
+if [ -f "${ignore_file}" ]; then
+  while IFS= read -r line; do
+    id="${line%%#*}"
+    id="$(echo "${id}" | tr -d '[:space:]')"
+    if [ -n "${id}" ]; then
+      args+=(--ignore-vuln "${id}")
+    fi
+  done < "${ignore_file}"
+fi
+
+uv run pip-audit "${args[@]}"