Add Gitea SSO, fix security audit findings, harden production defaults

Gitea SSO: cookie-based single sign-on via nginx auth_request — sets
cml_session cookie on login/refresh, validates via /api/auth/gitea-sso-validate,
injects X-WEBAUTH-USER header for reverse proxy auth. Dedicated GITEA_SSO_SECRET
and SERVICE_PASSWORD_SALT env vars isolate secret rotation.

Security fixes from March 30 audit: IDOR on ticketed events (requireEventOwnership
middleware), IDOR on action items (admin/assignee/creator check), path traversal
on photos (resolve-based validation), CSV upload size limit (5MB), shared calendar
email exposure removed.

Gitea provisioner: auto-sync docs repo collaborator access based on role
(CONTENT_ROLES get write, SUPER_ADMIN gets admin). Gitea client extended
with collaborator management API methods.

Production hardening: NODE_ENV defaults to production in docker-compose.prod.yml,
Grafana anonymous auth disabled, install.sh branch ref updated to main.

Admin UI: moved docs reset from toolbar to MkDocs Settings danger zone,
improved collab Ctrl+S to explicitly save + cache-bust preview.

MkDocs site rebuild with updated repo data, upgrade screenshots, and content.

Bunker Admin

.env.example

@@ -53,6 +53,14 @@ JWT_REFRESH_EXPIRY=7d
 # Generate with: openssl rand -hex 32
 ENCRYPTION_KEY=GENERATE_WITH_openssl_rand_hex_32
 
+# Gitea SSO cookie signing secret (separate from JWT — falls back to JWT_ACCESS_SECRET if empty)
+# Generate with: openssl rand -hex 32
+GITEA_SSO_SECRET=
+# Salt for deriving deterministic service passwords (Gitea, Rocket.Chat)
+# Falls back to JWT_ACCESS_SECRET if empty — set a dedicated value to isolate secret rotation
+# Generate with: openssl rand -hex 32
+SERVICE_PASSWORD_SALT=
+
 # --- Initial Super Admin User (auto-created during database seeding) ---
 # These credentials are used to create the initial super admin account
 # Change these before running the seed script in production