docs: local vs server quickstart, authz model, packaging

Reframe the README around two transports and add a local stdio quickstart with
uvx/pip and Claude Desktop / Claude Code wiring. New docs: local-quickstart.md
and packaging.md (uv build/publish). Document resource-type-aware authorization
and classified gitea_request in security.md; stdio env vars + audit-log
fallback in configuration.md; local install in deployment.md; core+adapters in
architecture.md. Add the missing root AGENTS.md contract, update CLAUDE.md with
the core/adapter layout, fail-closed invariants, and the branching flow
(HEAD -> feature -> dev -> main). Update roadmap/todo and .env.example.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

docs/roadmap.md

@@ -7,6 +7,8 @@
 3. Controlled write-mode rollout.
 4. Automation and event-driven workflows.
 5. Continuous hardening and enterprise controls.
+6. Dual transport (HTTP/OAuth + local stdio) on a shared core, with safe
+   full-API coverage and resource-type-aware authorization (0.2.0).
 
 ## Threat Model Updates