Security fixes: - Rust: Enforce minimum 32-byte secret key length for HMAC-SHA256 - TypeScript: Default to sessionStorage instead of localStorage - TypeScript: Add HTTPS enforcement for production URLs - Gateway: Add redirect URI validation against registered callback URLs - Docker: Bind port to localhost only (127.0.0.1:3100) - Config: Update .env.example with security notices and empty defaults Cleanup: - Remove Gitea-specific workflow (use GitHub Actions instead)