feat: new settings, CLI skeleton and interface skeletons

Adds the pydantic-settings Settings with validated GITEA_URL, OAuth scopes
and toolsets, the argparse CLI skeleton, catalog.model, identity and
GiteaAPIError. Test fixtures now isolate env, cwd and state paths in tmp.

src/aegis_gitea_mcp/audit.py

@@ -2,6 +2,7 @@
 
 from __future__ import annotations
 
+import contextlib
 import hashlib
 import json
 import threading
@@ -31,10 +32,11 @@ class AuditLogger:
             log_path: Path to audit log file (defaults to config value).
         """
         self.settings = get_settings()
-        self.log_path = log_path or self.settings.audit_log_path
+        self.log_path = log_path or self.settings.resolved_audit_log_path
         self.log_path.parent.mkdir(parents=True, exist_ok=True)
         self._lock = threading.Lock()
-        self._log_file = open(self.log_path, "a+", encoding="utf-8")
+        # Held open for the process lifetime; closed in close().
+        self._log_file = open(self.log_path, "a+", encoding="utf-8")  # noqa: SIM115
         self._last_hash = self._read_last_hash()
 
     def _read_last_hash(self) -> str:
@@ -82,7 +84,7 @@ class AuditLogger:
             payload["correlation_id"] = correlation_id
 
         # Security decision: sanitize all audit payloads before persistence.
-        mode = "mask" if self.settings.secret_detection_mode != "off" else "off"
+        mode = "mask" if self.settings.secret_detection_mode != "off" else "off"  # noqa: S105
         safe_payload = payload if mode == "off" else sanitize_data(payload, mode=mode)
 
         base_entry: dict[str, Any] = {
@@ -108,10 +110,8 @@ class AuditLogger:
 
     def close(self) -> None:
         """Close open audit log resources."""
-        try:
+        with contextlib.suppress(OSError):
             self._log_file.close()
-        except Exception:
-            pass
 
     def log_tool_invocation(
         self,