ci: raise the coverage gate to 90 percent; docs: reconcile OAuth docs with the implementation

docs/hardening.md

@@ -27,7 +27,13 @@ authentication), but it does not decide what is safe. This checklist is how you
   header).
 - `TOKEN_ENCRYPTION_KEY` protects the stored per-user tokens. Keep it separate from the data
   volume backups. `GITEA_OAUTH_CLIENT_SECRET` likewise.
-- Use `setup`, which writes the env file with mode 0600 and never prints secrets.
+- Use `setup`, which writes the env file with mode 0600 and never prints secrets. The server
+  loads `./.env` only while it is a regular file you own with mode 0600; keep it elsewhere with
+  `--env-file` or `AEGIS_ENV_FILE`.
+- For a public OAuth deployment set `OAUTH_REDIRECT_ALLOWLIST` (for example
+  `https://claude.ai/,https://chat.mistral.ai/`), so only the hosted clients you use can
+  register, and leave `MCP_BEARER_TOKEN` and `GITEA_TOKEN` unset when nobody needs the admin
+  identity.
 - Do not paste tokens into chat with the assistant, and do not commit `.env`.
 
 ## Network and transport