feat(admin): local-only stdio MCP server to mint scoped service-account tokens (dispatch#67)

dispatch#67 fix #2 needed a read-only CI credential and hit a hard wall:
Gitea's own token-creation and admin-user endpoints reject token auth
outright -- POST /users/{u}/tokens returns 'auth required', POST
/admin/users returns 'token does not have at least one of required
scope(s), required=[write:admin]' -- for ANY existing token, by design. An
existing token cannot mint another token or create an account; the only
way through either endpoint is real basic auth as an actual site admin.
That is exactly what a sandboxed agent session cannot safely hold.

internal/adminbootstrap: the core bootstrap, HTTP-only, fully testable
against a fake transport (5 tests, no network). Given real admin
username/password, it creates the target account (or resets its password
if it already exists -- deliberately unconditional, gated behind a
required ConfirmServiceAccount flag since that reset is only safe for a
dedicated bot account), mints it a scoped token by authenticating AS that
account (Gitea requires this specifically -- an admin cannot mint on
another account's behalf), grants it read-only collaborator access on
named repos, and stores the result via a SecretStore -- never returning
the token or either password to the caller.

internal/localtools: the MCP tool wrapper (mint_service_account_token) and
the real op-CLI-backed SecretStore (token passed via stdin, never argv,
per the estate's own secret-handling rule). Deliberately its OWN package,
not internal/tools -- this capability is far too dangerous to risk it ever
being wired into RegisterAll and reachable from the shared HTTP gitea-mcp
server, even behind OIDC.

internal/mcp/stdio.go: a stdio JSON-RPC transport (one message per line,
standard MCP stdio framing) for the existing registry.Tool interface --
the only transport gitea-mcp had before this was HTTP (server.go), which a
sandboxed session can reach but a real admin password never should be
piped through.

cmd/gitea-admin-mcp: the binary. Meant to be spawned by a LOCAL Claude Code
session (.mcp.json stdio server) or run by hand, via 'op run --env-file
~/.op-env' so admin credentials arrive just-in-time and never touch a
sandboxed session.

11 new tests total, all passing under -race. Nothing in cmd/gitea-mcp (the
shared HTTP server) changed.

internal/localtools/opsecretstore_test.go

@@ -0,0 +1,52 @@
+package localtools_test
+
+import (
+	"context"
+	"testing"
+
+	"git.d-ma.be/mathias/gitea-mcp/internal/localtools"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// The estate's own secret-handling rule: never place a literal secret in a
+// command's argv — it lands in process listings and any transcript of the
+// command. OpSecretStore feeds the token to `op` via stdin instead.
+
+func TestOpSecretStore_PassesValueViaStdinNeverArgv(t *testing.T) {
+	var gotStdin string
+	var gotArgs []string
+	s := localtools.OpSecretStore{
+		Vault: "AgentSecrets",
+		Run: func(_ context.Context, stdin string, args ...string) error {
+			gotStdin = stdin
+			gotArgs = args
+			return nil
+		},
+	}
+
+	ref, err := s.Store(context.Background(), "gitea-dispatch-bot-ci-readonly", "tok_the_actual_secret_value")
+
+	require.NoError(t, err)
+	assert.Equal(t, "op://AgentSecrets/gitea-dispatch-bot-ci-readonly/credential", ref)
+	assert.Equal(t, "tok_the_actual_secret_value", gotStdin)
+	for _, a := range gotArgs {
+		assert.NotContains(t, a, "tok_the_actual_secret_value",
+			"the secret value must never appear as a literal argv element")
+	}
+	assert.Contains(t, gotArgs, "--vault=AgentSecrets")
+	assert.Contains(t, gotArgs, "--title=gitea-dispatch-bot-ci-readonly")
+}
+
+func TestOpSecretStore_PropagatesRunError(t *testing.T) {
+	s := localtools.OpSecretStore{
+		Vault: "AgentSecrets",
+		Run: func(_ context.Context, _ string, _ ...string) error {
+			return assert.AnError
+		},
+	}
+
+	_, err := s.Store(context.Background(), "x", "y")
+
+	require.Error(t, err)
+}