feat: new settings, CLI skeleton and interface skeletons

Adds the pydantic-settings Settings with validated GITEA_URL, OAuth scopes
and toolsets, the argparse CLI skeleton, catalog.model, identity and
GiteaAPIError. Test fixtures now isolate env, cwd and state paths in tmp.

tests/test_identity.py

@@ -0,0 +1,31 @@
+"""Tests for the identity type."""
+
+from __future__ import annotations
+
+import dataclasses
+
+import pytest
+
+from aegis_gitea_mcp.identity import Identity
+
+
+def test_metadata_never_contains_token() -> None:
+    identity = Identity(login="alice", mode="oauth", token="super-secret-token")
+
+    assert identity.metadata() == {"login": "alice", "mode": "oauth", "sudo": None}
+    assert identity.metadata(sudo="bob") == {"login": "alice", "mode": "oauth", "sudo": "bob"}
+    assert "super-secret-token" not in str(identity.metadata(sudo="bob"))
+
+
+def test_token_hidden_from_repr() -> None:
+    identity = Identity(login=None, mode="admin-token", token="super-secret-token")
+
+    assert "super-secret-token" not in repr(identity)
+    assert "super-secret-token" not in str(identity)
+    assert "login=None" in repr(identity)
+
+
+def test_identity_is_frozen() -> None:
+    identity = Identity(login="a", mode="admin-token", token="t")
+    with pytest.raises(dataclasses.FrozenInstanceError):
+        identity.login = "b"  # type: ignore[misc]