feat: harden OAuth state secret validation, DCR file permissions, and policy defaults

- Enforce 32-char minimum on OAUTH_STATE_SECRET at startup (config.py)
- Write DCR client registry with owner-only (0o600) permissions before atomic replace
- Flip policy.yaml default write action from allow → deny
- Add CLAUDE.md with architecture, commands, and AGENTS.md contract summary
- Add .pre-commit-config.yaml mirroring `make lint` checks
- Update .gitignore: add .venv, .claude, .mypy_cache, .ruff_cache, .coverage.*
- Extend docs: audit log rotation guidance, OAUTH_STATE_SECRET and DCR_STORAGE_PATH notes
- Tests: short-secret rejection, 32-char acceptance, POSIX permission check for DCR store

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

tests/test_config.py

@@ -106,3 +106,33 @@ def test_write_mode_allows_all_token_repos(monkeypatch: pytest.MonkeyPatch) -> N
     reset_settings()
     settings = get_settings()
     assert settings.write_allow_all_token_repos is True
+
+
+def _oauth_env(monkeypatch: pytest.MonkeyPatch) -> None:
+    """Apply a minimal, valid OAuth-mode environment."""
+    monkeypatch.setenv("GITEA_URL", "https://gitea.example.com")
+    monkeypatch.setenv("OAUTH_MODE", "true")
+    monkeypatch.setenv("GITEA_OAUTH_CLIENT_ID", "test-client-id")
+    monkeypatch.setenv("GITEA_OAUTH_CLIENT_SECRET", "test-client-secret")
+    monkeypatch.setenv("STARTUP_VALIDATE_GITEA", "false")
+
+
+def test_oauth_state_secret_too_short_is_rejected(monkeypatch: pytest.MonkeyPatch) -> None:
+    """OAUTH_STATE_SECRET shorter than 32 characters must fail validation."""
+    _oauth_env(monkeypatch)
+    monkeypatch.setenv("OAUTH_STATE_SECRET", "short-secret")
+
+    reset_settings()
+    with pytest.raises(ValidationError, match="at least 32 characters"):
+        get_settings()
+
+
+def test_oauth_state_secret_minimum_length_accepted(monkeypatch: pytest.MonkeyPatch) -> None:
+    """A 32+ character OAUTH_STATE_SECRET passes validation."""
+    _oauth_env(monkeypatch)
+    monkeypatch.setenv("OAUTH_STATE_SECRET", "x" * 32)
+
+    reset_settings()
+    settings = get_settings()
+    assert settings.oauth_mode is True
+    assert len(settings.oauth_state_secret) == 32