Add OAuth2/OIDC per-user Gitea authentication

Introduce a GiteaOAuthValidator for JWT and userinfo validation and
fallbacks, add /oauth/token proxy, and thread per-user tokens through
the
request context and automation paths. Update config and .env.example for
OAuth-first mode, add OpenAPI, extensive unit/integration tests,
GitHub/Gitea CI workflows, docs, and lint/test enforcement (>=80% cov).

tests/test_automation.py

@@ -6,6 +6,21 @@ import pytest
 from fastapi.testclient import TestClient
 
 
+@pytest.fixture
+def allow_oauth(monkeypatch: pytest.MonkeyPatch) -> None:
+    """Mock OAuth validation to return a deterministic authenticated principal."""
+
+    async def _validate(_self, token, _ip, _ua):
+        if token == "a" * 64:
+            return True, None, {"login": "automation-user", "scopes": ["read:repository"]}
+        return False, "Invalid or expired OAuth token.", None
+
+    monkeypatch.setattr(
+        "aegis_gitea_mcp.oauth.GiteaOAuthValidator.validate_oauth_token",
+        _validate,
+    )
+
+
 def _set_base_env(
     monkeypatch: pytest.MonkeyPatch, automation_enabled: bool, policy_path: Path
 ) -> None:
@@ -20,7 +35,7 @@ def _set_base_env(
 
 
 def test_automation_job_denied_when_disabled(
-    monkeypatch: pytest.MonkeyPatch, tmp_path: Path
+    monkeypatch: pytest.MonkeyPatch, tmp_path: Path, allow_oauth: None
 ) -> None:
     """Automation endpoints should deny requests when automation mode is disabled."""
     policy_path = tmp_path / "policy.yaml"
@@ -41,7 +56,7 @@ def test_automation_job_denied_when_disabled(
 
 
 def test_automation_job_executes_when_enabled(
-    monkeypatch: pytest.MonkeyPatch, tmp_path: Path
+    monkeypatch: pytest.MonkeyPatch, tmp_path: Path, allow_oauth: None
 ) -> None:
     """Dependency scan job should execute when automation is enabled and policy allows it."""
     policy_path = tmp_path / "policy.yaml"
@@ -74,7 +89,9 @@ tools:
     assert payload["result"]["job"] == "dependency_hygiene_scan"
 
 
-def test_automation_webhook_policy_denied(monkeypatch: pytest.MonkeyPatch, tmp_path: Path) -> None:
+def test_automation_webhook_policy_denied(
+    monkeypatch: pytest.MonkeyPatch, tmp_path: Path, allow_oauth: None
+) -> None:
     """Webhook ingestion must respect policy deny rules."""
     policy_path = tmp_path / "policy.yaml"
     policy_path.write_text(
@@ -104,7 +121,7 @@ tools:
 
 
 def test_auto_issue_creation_denied_without_write_mode(
-    monkeypatch: pytest.MonkeyPatch, tmp_path: Path
+    monkeypatch: pytest.MonkeyPatch, tmp_path: Path, allow_oauth: None
 ) -> None:
     """Auto issue creation job should be denied unless write mode is enabled."""
     policy_path = tmp_path / "policy.yaml"