feat: JSON multi-profile runtime config for Gitea MCP (roadmap #10)

Let one MCP server select among named Gitea runtime profiles from a JSON file
instead of editing code or juggling many .env files:

    GITEA_MCP_CONFIG=/path/to/gitea-mcp.json
    GITEA_MCP_PROFILE=dev

- New gitea_config.py: load/validate the JSON, select the named profile, and
  resolve its token by env-var reference. Profiles supply base_url,
  profile_name, token_env, owner/repo, allowed/forbidden operations, and audit
  label.
- gitea_auth.get_profile() now overlays env over the selected JSON profile:
  explicit env vars win, the JSON profile fills only what env leaves unset.
- gitea_auth.get_auth_header() gains a JSON token_env fallback after explicit
  env tokens (env still wins).

Security / safety:
- Tokens are referenced by env-var NAME (token_env); an inline "token" is
  rejected and never echoed. The value is never stored in or returned as
  profile metadata.
- Fail-safe errors: missing file / invalid JSON / unknown or unset selected
  profile raise a clear ConfigError that never prints file contents or tokens
  (JSONDecodeError context is suppressed so the raw file text can't surface).
- No network calls during config parsing.
- Real config files are gitignored (gitea-mcp*.json), example kept.

Backwards compatible: with GITEA_MCP_CONFIG unset, behaviour is exactly the
prior env-only behaviour (all existing get_profile/get_auth_header tests pass
unchanged).

Docs: README JSON-profiles section + env table rows, .env.example placeholders,
gitea-mcp.example.json.
Tests: tests/test_config.py (22 cases) — env-only, selection, multiple
profiles, env-override precedence, missing file, invalid JSON, missing/unset
profile, inline-token rejection + redaction, and no-network-during-parse.

Refs #10. Note: issue #19 (env-based profiles) was already implemented and
closed; this JSON-file capability is adjacent new scope tracked under the
roadmap rather than reopening #19.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

gitea-mcp.example.json

@@ -0,0 +1,24 @@
+{
+  "profiles": {
+    "dev": {
+      "base_url": "https://gitea.dev.example",
+      "profile_name": "gitea-author",
+      "token_env": "GITEA_TOKEN_DEV",
+      "owner": "Scaled-Tech-Consulting",
+      "repo": "Gitea-Tools",
+      "allowed_operations": ["read", "pr.create"],
+      "forbidden_operations": ["merge"],
+      "audit_label": "dev-author"
+    },
+    "prod-readonly": {
+      "base_url": "https://gitea.prgs.cc",
+      "profile_name": "gitea-readonly",
+      "token_env": "GITEA_TOKEN_PROD",
+      "owner": "Scaled-Tech-Consulting",
+      "repo": "Gitea-Tools",
+      "allowed_operations": ["read"],
+      "forbidden_operations": ["merge", "approve", "request_changes"],
+      "audit_label": "prod-ro"
+    }
+  }
+}