docs: local vs server quickstart, authz model, packaging

Reframe the README around two transports and add a local stdio quickstart with
uvx/pip and Claude Desktop / Claude Code wiring. New docs: local-quickstart.md
and packaging.md (uv build/publish). Document resource-type-aware authorization
and classified gitea_request in security.md; stdio env vars + audit-log
fallback in configuration.md; local install in deployment.md; core+adapters in
architecture.md. Add the missing root AGENTS.md contract, update CLAUDE.md with
the core/adapter layout, fail-closed invariants, and the branching flow
(HEAD -> feature -> dev -> main). Update roadmap/todo and .env.example.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

docs/deployment.md

@@ -8,7 +8,20 @@
 - Policy checks run before tool execution.
 - OAuth-protected MCP challenge responses are enabled by default for tool calls.
 
-## Local Development
+## Local stdio install (single user)
+
+The local transport needs only the core package (no web stack):
+
+```bash
+pip install aegis-gitea-mcp            # or: uvx aegis-gitea-mcp
+GITEA_URL=https://git.hiddenden.cafe GITEA_TOKEN=<pat> aegis-gitea-mcp
+```
+
+It authenticates with your Gitea PAT, runs policy + `WRITE_MODE` + audit, and
+serves over stdio for Claude Desktop / Claude Code. See
+[local-quickstart.md](local-quickstart.md).
+
+## Local Development (HTTP server)
 
 ```bash
 make install-dev
@@ -16,6 +29,14 @@ cp .env.example .env
 make run
 ```
 
+The HTTP server requires the web stack. From a published package that is the
+`[server]` extra:
+
+```bash
+pip install 'aegis-gitea-mcp[server]'
+aegis-gitea-mcp-server
+```
+
 ## Docker
 
 Use `docker/Dockerfile`: