feat: harden OAuth state secret validation, DCR file permissions, and policy defaults

- Enforce 32-char minimum on OAUTH_STATE_SECRET at startup (config.py)
- Write DCR client registry with owner-only (0o600) permissions before atomic replace
- Flip policy.yaml default write action from allow → deny
- Add CLAUDE.md with architecture, commands, and AGENTS.md contract summary
- Add .pre-commit-config.yaml mirroring `make lint` checks
- Update .gitignore: add .venv, .claude, .mypy_cache, .ruff_cache, .coverage.*
- Extend docs: audit log rotation guidance, OAUTH_STATE_SECRET and DCR_STORAGE_PATH notes
- Tests: short-secret rejection, 32-char acceptance, POSIX permission check for DCR store

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

src/aegis_gitea_mcp/config.py

@@ -323,6 +323,12 @@ class Settings(BaseSettings):
                     "OAUTH_STATE_SECRET is required when OAUTH_MODE=true so the OAuth "
                     "proxy state parameter can be HMAC-signed and verified."
                 )
+            # A short secret weakens the HMAC; require the same 32-char floor as API keys.
+            if len(self.oauth_state_secret.strip()) < 32:
+                raise ValueError(
+                    "OAUTH_STATE_SECRET must be at least 32 characters long "
+                    "(e.g. `openssl rand -hex 32`)."
+                )
         else:
             # Standard API key mode: require bot token and at least one API key.
             if not self.gitea_token.strip():