Add Gitea SSO, fix security audit findings, harden production defaults

Gitea SSO: cookie-based single sign-on via nginx auth_request — sets
cml_session cookie on login/refresh, validates via /api/auth/gitea-sso-validate,
injects X-WEBAUTH-USER header for reverse proxy auth. Dedicated GITEA_SSO_SECRET
and SERVICE_PASSWORD_SALT env vars isolate secret rotation.

Security fixes from March 30 audit: IDOR on ticketed events (requireEventOwnership
middleware), IDOR on action items (admin/assignee/creator check), path traversal
on photos (resolve-based validation), CSV upload size limit (5MB), shared calendar
email exposure removed.

Gitea provisioner: auto-sync docs repo collaborator access based on role
(CONTENT_ROLES get write, SUPER_ADMIN gets admin). Gitea client extended
with collaborator management API methods.

Production hardening: NODE_ENV defaults to production in docker-compose.prod.yml,
Grafana anonymous auth disabled, install.sh branch ref updated to main.

Admin UI: moved docs reset from toolbar to MkDocs Settings danger zone,
improved collab Ctrl+S to explicitly save + cache-bust preview.

MkDocs site rebuild with updated repo data, upgrade screenshots, and content.

Bunker Admin

mkdocs/docs/blog/posts/2026-03-27-test-blog-post.md

@@ -0,0 +1,12 @@
+---
+date: 2026-03-27
+authors:
+  - admin
+categories:
+  - Testing
+draft: false
+---
+
+# Test Blog Post - Version 7
+
+This version uses the auto-setup token.

mkdocs/docs/blog/posts/introducing-changemaker-lite-v2.md

@@ -55,7 +55,7 @@ Read more in our [Philosophy](../../docs/phil.md) page.
 ## Get Started
 
 ```bash
-curl -fsSL https://gitea.bnkops.com/admin/changemaker.lite/raw/branch/v2/scripts/install.sh | bash
+curl -fsSL https://gitea.bnkops.com/admin/changemaker.lite/raw/branch/main/scripts/install.sh | bash
 ```
 
 Or follow the [Getting Started guide](../../docs/getting-started/index.md) for a walkthrough.