feat: new settings, CLI skeleton and interface skeletons

Adds the pydantic-settings Settings with validated GITEA_URL, OAuth scopes
and toolsets, the argparse CLI skeleton, catalog.model, identity and
GiteaAPIError. Test fixtures now isolate env, cwd and state paths in tmp.

tests/conftest.py

@@ -1,4 +1,11 @@
-"""Pytest configuration and fixtures."""
+"""Pytest configuration and fixtures.
+
+Every test runs with a scrubbed environment, an empty working directory (so a
+developer's own ``.env`` is never read) and state paths inside ``tmp_path``.
+Nothing may write to ``/var/log``, ``/var/lib`` or the real home directory.
+"""
+
+from __future__ import annotations
 
 from collections.abc import Generator
 from pathlib import Path
@@ -6,77 +13,37 @@ from pathlib import Path
 import pytest
 
 from aegis_gitea_mcp.audit import reset_audit_logger
-from aegis_gitea_mcp.auth import reset_validator
-from aegis_gitea_mcp.authz import reset_authz_caches
-from aegis_gitea_mcp.config import reset_settings
-from aegis_gitea_mcp.oauth import reset_oauth_validator
-from aegis_gitea_mcp.oauth_flow import reset_oauth_client_registry
-from aegis_gitea_mcp.observability import reset_metrics_registry
-from aegis_gitea_mcp.policy import reset_policy_engine
+from aegis_gitea_mcp.config import Settings, reset_settings
 from aegis_gitea_mcp.rate_limit import reset_rate_limiter
 from aegis_gitea_mcp.request_context import clear_gitea_auth_context
-from aegis_gitea_mcp.server import reset_repo_authz_cache
+
+
+def _reset_singletons() -> None:
+    """Reset every module-level singleton."""
+    reset_settings()
+    reset_audit_logger()
+    reset_rate_limiter()
+    clear_gitea_auth_context()
 
 
 @pytest.fixture(autouse=True)
 def reset_globals(tmp_path: Path, monkeypatch: pytest.MonkeyPatch) -> Generator[None, None, None]:
-    """Reset global singletons between tests and set up temp audit log."""
-    # Reset singletons before each test to ensure clean state
-    reset_settings()
-    reset_audit_logger()
-    reset_validator()
-    reset_oauth_validator()
-    reset_oauth_client_registry()
-    reset_repo_authz_cache()
-    reset_authz_caches()
-    reset_policy_engine()
-    reset_rate_limiter()
-    reset_metrics_registry()
-    clear_gitea_auth_context()
+    """Isolate each test: clean env, tmp cwd, tmp state paths, fresh singletons."""
+    for field_name in Settings.model_fields:
+        monkeypatch.delenv(field_name.upper(), raising=False)
+    monkeypatch.chdir(tmp_path)
 
-    # Use temporary directory for audit logs in tests
-    audit_log_path = tmp_path / "audit.log"
-    monkeypatch.setenv("AUDIT_LOG_PATH", str(audit_log_path))
+    data_dir = tmp_path / "data"
+    monkeypatch.setenv("DATA_DIR", str(data_dir))
+    monkeypatch.setenv("AUDIT_LOG_PATH", str(data_dir / "audit.log"))
 
+    _reset_singletons()
     yield
-
-    # Also reset after test for cleanup
-    reset_settings()
-    reset_audit_logger()
-    reset_validator()
-    reset_oauth_validator()
-    reset_oauth_client_registry()
-    reset_repo_authz_cache()
-    reset_authz_caches()
-    reset_policy_engine()
-    reset_rate_limiter()
-    reset_metrics_registry()
-    clear_gitea_auth_context()
+    _reset_singletons()
 
 
 @pytest.fixture
 def mock_env(monkeypatch: pytest.MonkeyPatch) -> None:
-    """Set up mock environment variables for testing (standard API key mode)."""
+    """Minimal valid environment: a Gitea URL and a token."""
     monkeypatch.setenv("GITEA_URL", "https://gitea.example.com")
     monkeypatch.setenv("GITEA_TOKEN", "test-token-12345")
-    monkeypatch.setenv("ENVIRONMENT", "test")
-    monkeypatch.setenv("MCP_HOST", "127.0.0.1")
-    monkeypatch.setenv("MCP_PORT", "8080")
-    monkeypatch.setenv("LOG_LEVEL", "DEBUG")
-    monkeypatch.setenv("MCP_API_KEYS", "a" * 64)
-    monkeypatch.setenv("STARTUP_VALIDATE_GITEA", "false")
-
-
-@pytest.fixture
-def mock_env_oauth(monkeypatch: pytest.MonkeyPatch) -> None:
-    """Set up mock environment variables for OAuth mode testing."""
-    monkeypatch.setenv("GITEA_URL", "https://gitea.example.com")
-    monkeypatch.setenv("ENVIRONMENT", "test")
-    monkeypatch.setenv("MCP_HOST", "127.0.0.1")
-    monkeypatch.setenv("MCP_PORT", "8080")
-    monkeypatch.setenv("LOG_LEVEL", "DEBUG")
-    monkeypatch.setenv("OAUTH_MODE", "true")
-    monkeypatch.setenv("GITEA_OAUTH_CLIENT_ID", "test-client-id")
-    monkeypatch.setenv("GITEA_OAUTH_CLIENT_SECRET", "test-client-secret")
-    monkeypatch.setenv("OAUTH_STATE_SECRET", "test-state-secret-0123456789abcdef")
-    monkeypatch.setenv("STARTUP_VALIDATE_GITEA", "false")