feat: support separate Gitea MCP runtime profiles via env config (#19)

Allow the same MCP server to run as separate MCP entries, each with its
own token and profile name, so roles stay task-scoped (the profile is
the role, not the LLM).

- gitea_auth.get_profile(): reads GITEA_PROFILE_NAME,
  GITEA_ALLOWED_OPERATIONS, GITEA_BASE_URL as non-secret metadata.
  Never reads/returns/logs the token.
- gitea_whoami now surfaces the safe profile metadata (name + allowed
  operations) alongside identity; token still never exposed.
- .env.example: placeholder-only template for a runtime profile.
- .gitignore: track .env.example while keeping real .env* ignored.
- README: document multiple env-configured MCP entries.
- tests: profile defaults/parsing, token-never-included, whoami surfaces
  profile without leaking token.

One token + one profile per process. No multi-token switching in a
single runtime. No approve/merge/eligibility workflow. No
Jenkins/Ops/GlitchTip/Release/deploy behavior. No real secrets.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

.env.example

@@ -0,0 +1,24 @@
+# Gitea MCP runtime profile — EXAMPLE / PLACEHOLDERS ONLY.
+#
+# Copy to a real, gitignored env file (e.g. .env.reviewer) per runtime profile.
+# The same MCP server code is launched as separate MCP entries, each pointed at
+# a different env file so each process authenticates as ONE token and carries
+# ONE profile name. Do NOT put real tokens in this file.
+#
+# The token is read only by the auth layer; it is never returned, logged, or
+# committed. Profile name and allowed operations are non-secret metadata.
+
+# Base URL of the Gitea instance (informational).
+GITEA_BASE_URL=https://gitea.example.invalid
+
+# The API token for THIS runtime profile. Placeholder only — replace in a real,
+# gitignored env file. Never commit a real token.
+GITEA_TOKEN=replace-with-token
+
+# Human label for the running profile (non-secret metadata).
+# Examples: gitea-author, gitea-reviewer, gitea-merger, gitea-issue-manager.
+GITEA_PROFILE_NAME=gitea-reviewer
+
+# Optional, comma-separated operation categories this profile is intended for
+# (descriptive only in this issue; enforcement is a later roadmap item).
+GITEA_ALLOWED_OPERATIONS=read,review,approve