Add Gitea SSO, fix security audit findings, harden production defaults

Gitea SSO: cookie-based single sign-on via nginx auth_request — sets
cml_session cookie on login/refresh, validates via /api/auth/gitea-sso-validate,
injects X-WEBAUTH-USER header for reverse proxy auth. Dedicated GITEA_SSO_SECRET
and SERVICE_PASSWORD_SALT env vars isolate secret rotation.

Security fixes from March 30 audit: IDOR on ticketed events (requireEventOwnership
middleware), IDOR on action items (admin/assignee/creator check), path traversal
on photos (resolve-based validation), CSV upload size limit (5MB), shared calendar
email exposure removed.

Gitea provisioner: auto-sync docs repo collaborator access based on role
(CONTENT_ROLES get write, SUPER_ADMIN gets admin). Gitea client extended
with collaborator management API methods.

Production hardening: NODE_ENV defaults to production in docker-compose.prod.yml,
Grafana anonymous auth disabled, install.sh branch ref updated to main.

Admin UI: moved docs reset from toolbar to MkDocs Settings danger zone,
improved collab Ctrl+S to explicitly save + cache-bust preview.

MkDocs site rebuild with updated repo data, upgrade screenshots, and content.

Bunker Admin

mkdocs/site/blog/index.html

@@ -1434,6 +1434,8 @@ body.cm-search-active .md-header--cm-hidden .md-search__output {
       
         
       
+        
+      
     
     
     
@@ -1532,6 +1534,48 @@ body.cm-search-active .md-header--cm-hidden .md-search__output {
         
       </nav>
     
+    <div class="md-post__meta md-meta">
+      <ul class="md-meta__list">
+        <li class="md-meta__item">
+          <time datetime="2026-03-27 00:00:00+00:00">Mar 27, 2026</time></li>
+        
+          <li class="md-meta__item">
+            in
+            
+              <a href="category/testing/" class="md-meta__link">Testing</a></li>
+        
+        
+          
+          <li class="md-meta__item">
+            
+              1 min read
+            
+          </li>
+        
+        
+      </ul>
+      
+    </div>
+  </header>
+  <div class="md-post__content md-typeset">
+    <h2 id="test-blog-post-version-7"><a class="toclink" href="2026/03/27/test-blog-post---version-7/">Test Blog Post - Version 7</a></h2>
+<p>This version uses the auto-setup token.</p>
+    
+    
+  </div>
+</article>
+      
+        <article class="md-post md-post--excerpt">
+  <header class="md-post__header">
+    
+      <nav class="md-post__authors md-typeset">
+        
+          <span class="md-author">
+            <img src="https://gitea.bnkops.com/avatars/1" alt="Bunker Operations">
+          </span>
+        
+      </nav>
+    
     <div class="md-post__meta md-meta">
       <ul class="md-meta__list">
         <li class="md-meta__item">
@@ -1777,6 +1821,8 @@ body.cm-search-active .md-header--cm-hidden .md-search__output {
       
         <script src="../assets/js/scheduling-poll.js"></script>
       
+        <script src="../assets/js/straw-poll-widget.js"></script>
+      
         <script src="../javascripts/ad-widgets.js"></script>
       
         <script src="../javascripts/docs-comments.js"></script>