Add OAuth2/OIDC per-user Gitea authentication

Introduce a GiteaOAuthValidator for JWT and userinfo validation and
fallbacks, add /oauth/token proxy, and thread per-user tokens through
the
request context and automation paths. Update config and .env.example for
OAuth-first mode, add OpenAPI, extensive unit/integration tests,
GitHub/Gitea CI workflows, docs, and lint/test enforcement (>=80% cov).

.gitea/workflows/docker.yml

@@ -0,0 +1,74 @@
+name: docker
+
+on:
+  push:
+  pull_request:
+
+jobs:
+  lint:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: '3.12'
+      - name: Install dependencies
+        run: |
+          python -m pip install --upgrade pip
+          pip install -r requirements-dev.txt
+      - name: Run lint
+        run: |
+          ruff check src tests
+          ruff format --check src tests
+          black --check src tests
+          mypy src
+
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: '3.12'
+      - name: Install dependencies
+        run: |
+          python -m pip install --upgrade pip
+          pip install -r requirements-dev.txt
+      - name: Run tests
+        run: pytest --cov=aegis_gitea_mcp --cov-report=term-missing --cov-fail-under=80
+
+  docker-build:
+    runs-on: ubuntu-latest
+    needs: [lint, test]
+    env:
+      IMAGE_NAME: aegis-gitea-mcp
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Build image tagged with commit SHA
+        run: |
+          SHA_TAG="${GITHUB_SHA:-${CI_COMMIT_SHA:-local}}"
+          docker build -f docker/Dockerfile -t ${IMAGE_NAME}:${SHA_TAG} .
+
+      - name: Tag latest on main
+        run: |
+          REF_NAME="${GITHUB_REF_NAME:-${CI_COMMIT_REF_NAME:-}}"
+          SHA_TAG="${GITHUB_SHA:-${CI_COMMIT_SHA:-local}}"
+          if [ "${REF_NAME}" = "main" ]; then
+            docker tag ${IMAGE_NAME}:${SHA_TAG} ${IMAGE_NAME}:latest
+          fi
+
+      - name: Optional registry push
+        if: ${{ vars.PUSH_IMAGE == 'true' }}
+        run: |
+          SHA_TAG="${GITHUB_SHA:-${CI_COMMIT_SHA:-local}}"
+          docker push ${IMAGE_NAME}:${SHA_TAG}
+          REF_NAME="${GITHUB_REF_NAME:-${CI_COMMIT_REF_NAME:-}}"
+          if [ "${REF_NAME}" = "main" ]; then
+            docker push ${IMAGE_NAME}:latest
+          fi

.gitea/workflows/lint.yml

@@ -0,0 +1,34 @@
+name: lint
+
+on:
+  push:
+  pull_request:
+
+jobs:
+  lint:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: '3.12'
+
+      - name: Install dependencies
+        run: |
+          python -m pip install --upgrade pip
+          pip install -r requirements-dev.txt
+
+      - name: Run Ruff (fail on any diagnostics)
+        run: ruff check src tests
+
+      - name: Enforce formatting
+        run: |
+          ruff format --check src tests
+          black --check src tests
+
+      - name: Run mypy
+        run: mypy src

.gitea/workflows/test.yml

@@ -0,0 +1,33 @@
+name: test
+
+on:
+  push:
+  pull_request:
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: '3.12'
+
+      - name: Install dependencies
+        run: |
+          python -m pip install --upgrade pip
+          pip install -r requirements-dev.txt
+
+      - name: Run lint
+        run: |
+          ruff check src tests
+          ruff format --check src tests
+          black --check src tests
+
+      - name: Run tests with coverage gate
+        run: |
+          pytest --cov=aegis_gitea_mcp --cov-report=term-missing --cov-fail-under=80