docs: phase 0 audit, chunk plan, ADRs and pinned Gitea 28.1.0 swagger

Inventory and gap analysis of the 0.2.0 codebase against the full Gitea API
and the official gitea-mcp toolset, the B1..B11 + security chunk plan, ADRs
0001-0006 for the full-access rebuild, SDK/OAuth research notes, and the
instance swagger pinned for tool generation. The audit-logging doc moves to
docs/audit-logging.md.

docs/adr/0006-retire-legacy-modules.md

@@ -0,0 +1,22 @@
+# ADR 0006: retire the 0.x adapters and gates
+
+Status: accepted (2026-10-14)
+
+## Decision
+
+Remove: `server.py`, `server_entry.py`, `mcp_protocol.py`, `registry.py`,
+`tools/*`, `policy.py` and `policy.yaml`, `authz.py`, `auth.py`, `oauth.py`,
+`oauth_flow.py`, `automation.py`, `observability.py`, the API-key scripts, the
+`[server]` extra, black and `requirements*.txt` (replaced by `uv.lock`).
+
+Keep and adapt: `audit.py`, `security.py`, `response_limits.py`,
+`request_context.py`, `errors.py`, `logging_utils.py`, `config.py`,
+`rate_limit.py` (HTTP only), `scripts/validate_audit_log.py`.
+
+## Rationale
+
+The new catalog plus the SDK transports replace the adapters. The YAML policy
+and resource-type gate existed to restrict a shared service PAT; per-user OAuth
+now runs on the user's own token and the owner restricts admin mode with
+`READ_ONLY`/`TOOLSETS`/`DISABLED_TOOLS`. Automation and metrics are outside an
+API bridge's scope and were mostly scaffold. The release is a breaking 1.0.0.