feat: new settings, CLI skeleton and interface skeletons

Adds the pydantic-settings Settings with validated GITEA_URL, OAuth scopes
and toolsets, the argparse CLI skeleton, catalog.model, identity and
GiteaAPIError. Test fixtures now isolate env, cwd and state paths in tmp.

tests/test_validate_audit_script.py

@@ -0,0 +1,56 @@
+"""Tests for scripts/validate_audit_log.py."""
+
+from __future__ import annotations
+
+import importlib.util
+from pathlib import Path
+from types import ModuleType
+
+import pytest
+
+from aegis_gitea_mcp.audit import AuditLogger
+
+SCRIPT = Path(__file__).parent.parent / "scripts" / "validate_audit_log.py"
+
+
+def load_script() -> ModuleType:
+    spec = importlib.util.spec_from_file_location("validate_audit_log", SCRIPT)
+    assert spec is not None and spec.loader is not None
+    module = importlib.util.module_from_spec(spec)
+    spec.loader.exec_module(module)
+    return module
+
+
+def test_default_path_from_env(tmp_path: Path, monkeypatch: pytest.MonkeyPatch) -> None:
+    script = load_script()
+    monkeypatch.setenv("AUDIT_LOG_PATH", str(tmp_path / "x.log"))
+    assert script.default_audit_path() == tmp_path / "x.log"
+
+    monkeypatch.delenv("AUDIT_LOG_PATH")
+    monkeypatch.setenv("DATA_DIR", str(tmp_path / "d"))
+    assert script.default_audit_path() == tmp_path / "d" / "audit.log"
+
+    monkeypatch.delenv("DATA_DIR")
+    assert script.default_audit_path().name == "audit.log"
+    assert "aegis-gitea-mcp" in str(script.default_audit_path())
+
+
+def test_main_reports_ok_and_failure(
+    mock_env: None,
+    tmp_path: Path,
+    monkeypatch: pytest.MonkeyPatch,
+    capsys: pytest.CaptureFixture[str],
+) -> None:
+    script = load_script()
+    log_path = tmp_path / "audit.log"
+    logger = AuditLogger(log_path=log_path)
+    logger.log_tool_invocation("t")
+    logger.close()
+
+    monkeypatch.setattr("sys.argv", ["x", "--path", str(log_path)])
+    assert script.main() == 0
+    assert "integrity OK" in capsys.readouterr().out
+
+    log_path.write_text(log_path.read_text().replace('"t"', '"u"'), encoding="utf-8")
+    assert script.main() == 1
+    assert "FAILED" in capsys.readouterr().out