fix: reject whitespace and control characters in base URLs and warn on plain http Gitea (SEC-10)

src/aegis_gitea_mcp/cli.py

@@ -109,6 +109,13 @@ def run_serve(args: argparse.Namespace) -> int:
     if settings is None:
         return 2
     configure_logging(settings.log_level)
+    if settings.insecure_gitea_url():
+        print(
+            "aegis-gitea-mcp: warning: GITEA_URL uses plain http to a host that is not loopback: "
+            "the Gitea token, the OAuth client secret and every user's token travel unencrypted. "
+            "Use https",
+            file=sys.stderr,
+        )
     if settings.mcp_transport == "http":
         return transports.run_http(settings)
     return transports.run_stdio(settings)