fix: reject whitespace and control characters in base URLs and warn on plain http Gitea (SEC-10)

docs/configuration.md

@@ -36,7 +36,7 @@ when OAuth is on.
 
 | Variable | Default | Rules |
 |---|---|---|
-| `GITEA_URL` | required | `http` or `https`, must have a host, no credentials, query or fragment. A trailing `/api/v1` is removed. |
+| `GITEA_URL` | required | `http` or `https`, must have a host, no credentials, query or fragment, and no whitespace, backslash or control characters. A trailing `/api/v1` is removed and the URL is rebuilt from its parsed parts. Plain `http` to a host that is not loopback starts, but `serve` prints a warning on stderr because every token then travels unencrypted. |
 | `GITEA_TOKEN` | unset | Token for stdio and for admin-token mode on HTTP. Its scopes bound what the server can do. Required for stdio (exit code 2 without it). |
 
 ## Transport

docs/security.md

@@ -177,7 +177,10 @@ confirmation, `READ_ONLY`, `TOOLSETS`, `DISABLED_TOOLS` and narrow token scopes
   MCP path and the unauthenticated OAuth paths (`/register`, `/authorize`, `/token`, `/revoke`,
   consent, callback), before authentication. Client IPs come from `X-Forwarded-For` only for
   `FORWARDED_ALLOW_IPS`; a forwarded header from any other peer is ignored and logged once.
-- `PUBLIC_BASE_URL` must be https unless loopback. Gitea redirects are never followed.
+- `PUBLIC_BASE_URL` must be https unless loopback. `GITEA_URL` and `PUBLIC_BASE_URL` reject
+  whitespace, backslashes and control characters and are rebuilt from their parsed parts;
+  plain http `GITEA_URL` to a non-loopback host prints a startup warning. Gitea redirects are
+  never followed.
 - stdio: stdout carries JSON-RPC only; all logging goes to stderr.
 
 ### Per-user OAuth design