ci: single Gitea Actions pipeline, uv-based image, scoped docker cleanup

Replace lint/test/docker workflows with ci.yml (gitleaks, lint, test-unit, test-integration, test-mcp, build-and-push, docs-check, security). Rebuild the Dockerfile as a digest-pinned multi-stage uv build running as uid 1000, add .dockerignore, a hardened compose file and a gitleaks config. The integration harness now falls back to /etc/hostname and /proc/self to find its own container.

security/pip-audit-ignore.txt

@@ -0,0 +1,4 @@
+# Advisories ignored by `scripts/ci/pip_audit.sh`.
+# One vulnerability id per line (GHSA-..., PYSEC-..., CVE-...). '#' starts a comment.
+# Every entry needs a justification and an expiry here and a matching waiver in
+# docs/security.md. Keep this file empty unless a waiver is documented.