fix: load ./.env only when private and owned, add --env-file and AEGIS_ENV_FILE (SEC-04)

tests/conftest.py

@@ -13,12 +13,13 @@ from pathlib import Path
 import pytest
 
 from aegis_gitea_mcp.audit import reset_audit_logger
-from aegis_gitea_mcp.config import Settings, reset_settings
+from aegis_gitea_mcp.config import Settings, reset_settings, set_env_file
 from aegis_gitea_mcp.request_context import clear_gitea_auth_context
 
 
 def _reset_singletons() -> None:
     """Reset every module-level singleton."""
+    set_env_file(None)
     reset_settings()
     reset_audit_logger()
     clear_gitea_auth_context()
@@ -29,6 +30,7 @@ def reset_globals(tmp_path: Path, monkeypatch: pytest.MonkeyPatch) -> Generator[
     """Isolate each test: clean env, tmp cwd, tmp state paths, fresh singletons."""
     for field_name in Settings.model_fields:
         monkeypatch.delenv(field_name.upper(), raising=False)
+    monkeypatch.delenv("AEGIS_ENV_FILE", raising=False)
     monkeypatch.chdir(tmp_path)
 
     data_dir = tmp_path / "data"