Add Gitea SSO, fix security audit findings, harden production defaults

Gitea SSO: cookie-based single sign-on via nginx auth_request — sets
cml_session cookie on login/refresh, validates via /api/auth/gitea-sso-validate,
injects X-WEBAUTH-USER header for reverse proxy auth. Dedicated GITEA_SSO_SECRET
and SERVICE_PASSWORD_SALT env vars isolate secret rotation.

Security fixes from March 30 audit: IDOR on ticketed events (requireEventOwnership
middleware), IDOR on action items (admin/assignee/creator check), path traversal
on photos (resolve-based validation), CSV upload size limit (5MB), shared calendar
email exposure removed.

Gitea provisioner: auto-sync docs repo collaborator access based on role
(CONTENT_ROLES get write, SUPER_ADMIN gets admin). Gitea client extended
with collaborator management API methods.

Production hardening: NODE_ENV defaults to production in docker-compose.prod.yml,
Grafana anonymous auth disabled, install.sh branch ref updated to main.

Admin UI: moved docs reset from toolbar to MkDocs Settings danger zone,
improved collab Ctrl+S to explicitly save + cache-bust preview.

MkDocs site rebuild with updated repo data, upgrade screenshots, and content.

Bunker Admin

mkdocs/site/blog/2026/03/22/introducing-changemaker-lite-v2/index.html

@@ -17,6 +17,8 @@
       
       
       
+        <link rel="next" href="../../27/test-blog-post---version-7/">
+      
       
         
       
@@ -1432,6 +1434,8 @@ body.cm-search-active .md-header--cm-hidden .md-search__output {
       
         
       
+        
+      
     
     
     
@@ -1704,7 +1708,7 @@ body.cm-search-active .md-header--cm-hidden .md-search__output {
 
 
   
-    <a href="https://gitea.bnkops.com/admin/changemaker.lite/src/branch/v2/mkdocs/docs/blog/posts/introducing-changemaker-lite-v2.md" title="Edit this page" class="md-content__button md-icon" rel="edit">
+    <a href="https://gitea.bnkops.com/admin/changemaker.lite/src/branch/main/mkdocs/docs/blog/posts/introducing-changemaker-lite-v2.md" title="Edit this page" class="md-content__button md-icon" rel="edit">
       
       <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M10 20H6V4h7v5h5v3.1l2-2V8l-6-6H6c-1.1 0-2 .9-2 2v16c0 1.1.9 2 2 2h4zm10.2-7c.1 0 .3.1.4.2l1.3 1.3c.2.2.2.6 0 .8l-1 1-2.1-2.1 1-1c.1-.1.2-.2.4-.2m0 3.9L14.1 23H12v-2.1l6.1-6.1z"/></svg>
     </a>
@@ -1713,7 +1717,7 @@ body.cm-search-active .md-header--cm-hidden .md-search__output {
     
       
     
-    <a href="https://gitea.bnkops.com/admin/changemaker.lite/src/branch/v2/mkdocs/docs/blog/posts/introducing-changemaker-lite-v2.md" title="View source of this page" class="md-content__button md-icon">
+    <a href="https://gitea.bnkops.com/admin/changemaker.lite/src/branch/main/mkdocs/docs/blog/posts/introducing-changemaker-lite-v2.md" title="View source of this page" class="md-content__button md-icon">
       
       <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M17 18c.56 0 1 .44 1 1s-.44 1-1 1-1-.44-1-1 .44-1 1-1m0-3c-2.73 0-5.06 1.66-6 4 .94 2.34 3.27 4 6 4s5.06-1.66 6-4c-.94-2.34-3.27-4-6-4m0 6.5a2.5 2.5 0 0 1-2.5-2.5 2.5 2.5 0 0 1 2.5-2.5 2.5 2.5 0 0 1 2.5 2.5 2.5 2.5 0 0 1-2.5 2.5M9.27 20H6V4h7v5h5v4.07c.7.08 1.36.25 2 .49V8l-6-6H6a2 2 0 0 0-2 2v16a2 2 0 0 0 2 2h4.5a8.2 8.2 0 0 1-1.23-2"/></svg>
     </a>
@@ -1752,7 +1756,7 @@ body.cm-search-active .md-header--cm-hidden .md-search__output {
 <p>Changemaker Lite costs roughly the price of a VPS — often under $50/month for the full stack. But the real value isn't cost savings. It's <strong>control.</strong> No vendor can cut off your access. No acquisition can change your terms.</p>
 <p>Read more in our <a href="../../../../../docs/phil/">Philosophy</a> page.</p>
 <h2 id="get-started">Get Started<a class="headerlink" href="#get-started" title="Permanent link">&para;</a></h2>
-<div class="language-bash highlight"><pre><span></span><code><span id="__span-0-1"><a id="__codelineno-0-1" name="__codelineno-0-1" href="#__codelineno-0-1"></a>curl<span class="w"> </span>-fsSL<span class="w"> </span>https://gitea.bnkops.com/admin/changemaker.lite/raw/branch/v2/scripts/install.sh<span class="w"> </span><span class="p">|</span><span class="w"> </span>bash
+<div class="language-bash highlight"><pre><span></span><code><span id="__span-0-1"><a id="__codelineno-0-1" name="__codelineno-0-1" href="#__codelineno-0-1"></a>curl<span class="w"> </span>-fsSL<span class="w"> </span>https://gitea.bnkops.com/admin/changemaker.lite/raw/branch/main/scripts/install.sh<span class="w"> </span><span class="p">|</span><span class="w"> </span>bash
 </span></code></pre></div>
 <p>Or follow the <a href="../../../../../docs/getting-started/">Getting Started guide</a> for a walkthrough.</p>
 <h2 id="whats-next">What's Next<a class="headerlink" href="#whats-next" title="Permanent link">&para;</a></h2>
@@ -1803,6 +1807,30 @@ body.cm-search-active .md-header--cm-hidden .md-search__output {
         <footer class="md-footer">
   
     
+      
+        
+      
+      <nav class="md-footer__inner md-grid" aria-label="Footer" >
+        
+        
+          
+          <a href="../../27/test-blog-post---version-7/" class="md-footer__link md-footer__link--next" aria-label="Next: Test Blog Post - Version 7">
+            <div class="md-footer__title">
+              <span class="md-footer__direction">
+                Next
+              </span>
+              <div class="md-ellipsis">
+                Test Blog Post - Version 7
+              </div>
+            </div>
+            <div class="md-footer__button md-icon">
+              
+              <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M4 11v2h12l-5.5 5.5 1.42 1.42L19.84 12l-7.92-7.92L10.5 5.5 16 11z"/></svg>
+            </div>
+          </a>
+        
+      </nav>
+    
   
   <div class="md-footer-meta md-typeset">
     <div class="md-footer-meta__inner md-grid">
@@ -1940,6 +1968,8 @@ body.cm-search-active .md-header--cm-hidden .md-search__output {
       
         <script src="../../../../../assets/js/scheduling-poll.js"></script>
       
+        <script src="../../../../../assets/js/straw-poll-widget.js"></script>
+      
         <script src="../../../../../javascripts/ad-widgets.js"></script>
       
         <script src="../../../../../javascripts/docs-comments.js"></script>