feat: new settings, CLI skeleton and interface skeletons

Adds the pydantic-settings Settings with validated GITEA_URL, OAuth scopes
and toolsets, the argparse CLI skeleton, catalog.model, identity and
GiteaAPIError. Test fixtures now isolate env, cwd and state paths in tmp.

src/aegis_gitea_mcp/identity.py

@@ -0,0 +1,34 @@
+"""Identity a tool call runs as.
+
+Admin-token mode uses the configured ``GITEA_TOKEN`` (stdio, or the static MCP
+bearer on HTTP). OAuth mode uses the signed-in user's own Gitea token. The
+identity travels with each call so the executor can pick the right token and the
+result envelope and audit log can name who acted.
+"""
+
+from __future__ import annotations
+
+from dataclasses import dataclass, field
+from typing import Any, Literal
+
+IdentityMode = Literal["admin-token", "oauth"]
+
+
+@dataclass(frozen=True)
+class Identity:
+    """Who a tool call acts as.
+
+    Attributes:
+        login: Gitea login when known (``None`` until resolved).
+        mode: ``admin-token`` or ``oauth``.
+        token: Gitea token for this identity. Excluded from ``repr`` and never
+            part of :meth:`metadata`.
+    """
+
+    login: str | None
+    mode: IdentityMode
+    token: str = field(repr=False)
+
+    def metadata(self, sudo: str | None = None) -> dict[str, Any]:
+        """Return result and audit metadata: ``{"login", "mode", "sudo"}``, never the token."""
+        return {"login": self.login, "mode": self.mode, "sudo": sudo}