Add OAuth2/OIDC per-user Gitea authentication

Introduce a GiteaOAuthValidator for JWT and userinfo validation and
fallbacks, add /oauth/token proxy, and thread per-user tokens through
the
request context and automation paths. Update config and .env.example for
OAuth-first mode, add OpenAPI, extensive unit/integration tests,
GitHub/Gitea CI workflows, docs, and lint/test enforcement (>=80% cov).

src/aegis_gitea_mcp/request_context.py

@@ -5,6 +5,9 @@ from __future__ import annotations
 from contextvars import ContextVar
 
 _REQUEST_ID: ContextVar[str] = ContextVar("request_id", default="-")
+_GITEA_USER_TOKEN: ContextVar[str | None] = ContextVar("gitea_user_token", default=None)
+_GITEA_USER_LOGIN: ContextVar[str | None] = ContextVar("gitea_user_login", default=None)
+_GITEA_USER_SCOPES: ContextVar[tuple[str, ...]] = ContextVar("gitea_user_scopes", default=())
 
 
 def set_request_id(request_id: str) -> None:
@@ -15,3 +18,40 @@ def set_request_id(request_id: str) -> None:
 def get_request_id() -> str:
     """Get current request id from context-local state."""
     return _REQUEST_ID.get()
+
+
+def set_gitea_user_token(token: str) -> None:
+    """Store the per-request Gitea OAuth user token in context-local state."""
+    _GITEA_USER_TOKEN.set(token)
+
+
+def get_gitea_user_token() -> str | None:
+    """Get the per-request Gitea OAuth user token from context-local state."""
+    return _GITEA_USER_TOKEN.get()
+
+
+def set_gitea_user_login(login: str) -> None:
+    """Store the authenticated Gitea username in context-local state."""
+    _GITEA_USER_LOGIN.set(login)
+
+
+def get_gitea_user_login() -> str | None:
+    """Get the authenticated Gitea username from context-local state."""
+    return _GITEA_USER_LOGIN.get()
+
+
+def set_gitea_user_scopes(scopes: list[str] | set[str] | tuple[str, ...]) -> None:
+    """Store normalized OAuth scopes for the current request."""
+    _GITEA_USER_SCOPES.set(tuple(sorted({scope.strip() for scope in scopes if scope.strip()})))
+
+
+def get_gitea_user_scopes() -> tuple[str, ...]:
+    """Get OAuth scopes attached to the current request."""
+    return _GITEA_USER_SCOPES.get()
+
+
+def clear_gitea_auth_context() -> None:
+    """Reset per-request Gitea authentication context values."""
+    _GITEA_USER_TOKEN.set(None)
+    _GITEA_USER_LOGIN.set(None)
+    _GITEA_USER_SCOPES.set(())