feat: new settings, CLI skeleton and interface skeletons

Adds the pydantic-settings Settings with validated GITEA_URL, OAuth scopes
and toolsets, the argparse CLI skeleton, catalog.model, identity and
GiteaAPIError. Test fixtures now isolate env, cwd and state paths in tmp.

tests/test_no_host_paths.py

@@ -0,0 +1,19 @@
+"""Guard: the test environment must never point state at system directories."""
+
+from __future__ import annotations
+
+from pathlib import Path
+
+from aegis_gitea_mcp.audit import get_audit_logger
+from aegis_gitea_mcp.config import Settings
+
+
+def test_state_paths_are_inside_tmp(mock_env: None, tmp_path: Path) -> None:
+    settings = Settings()  # type: ignore[call-arg]
+    assert settings.data_dir.is_relative_to(tmp_path)
+    assert settings.resolved_audit_log_path.is_relative_to(tmp_path)
+    assert get_audit_logger().log_path.is_relative_to(tmp_path)
+
+
+def test_cwd_is_isolated(tmp_path: Path) -> None:
+    assert Path.cwd() == tmp_path