feat(auth): JWT-or-static middleware + /.well-known/oauth-protected-resource (issue #5)

- internal/auth/jwt.go: JWTValidator via lestrrat-go/jwx/v2, JWKS auto-refresh
- internal/auth/bearer.go: replace Gitea PAT validation with JWT->static->default chain
- internal/gitea/client.go: always use service PAT; remove TokenFromContext lookup
- internal/config/config.go: add DexIssuerURL, MCPAudience, MCPResourceURL, StaticToken
- cmd/gitea-mcp/main.go: wire validator, fix /.well-known to return real AS list
- bearer_test.go: rewrite for new API

internal/gitea/client.go

@@ -7,7 +7,6 @@ import (
 	"net/http"
 	"time"
 
-	"gitea.d-ma.be/mathias/gitea-mcp/internal/auth"
 	"github.com/hashicorp/golang-lru/v2/expirable"
 )
 
@@ -50,10 +49,7 @@ func (c *Client) doOnce(ctx context.Context, method, path string, body []byte) (
 	if err != nil {
 		return nil, 0, err
 	}
-	token := auth.TokenFromContext(ctx)
-	if token == "" {
-		token = c.token
-	}
+	token := c.token
 	if token != "" {
 		req.Header.Set("Authorization", "token "+token)
 	}
@@ -119,10 +115,7 @@ func (c *Client) doRaw(ctx context.Context, method, path string, body []byte) (*
 	if err != nil {
 		return nil, err
 	}
-	token := auth.TokenFromContext(ctx)
-	if token == "" {
-		token = c.token
-	}
+	token := c.token
 	if token != "" {
 		req.Header.Set("Authorization", "token "+token)
 	}