rescue(ms-gate-001): preserve uncommitted gatekeeper WIP found in canonical clone (Q19 O1, Jason 2026-08-25)

Gatekeeper module (Gitea PR-webhook -> pending merges), AddPendingMerges
migration, vitest-runner, webhook edits, compose/CI/env/docs touches.
Applied to the tree in a single event 2026-08-23 18:45, author unknown.
Base main@32896770 (2026-03-09). Rescued verbatim for remediation per
board row; no functional review implied.

docker-compose.yml

@@ -385,6 +385,9 @@ services:
       NEXT_PUBLIC_APP_URL: ${NEXT_PUBLIC_APP_URL:-http://localhost:3000}
       NEXT_PUBLIC_API_URL: ${NEXT_PUBLIC_API_URL:-http://localhost:3001}
       TRUSTED_ORIGINS: ${TRUSTED_ORIGINS:-}
+      GITEA_WEBHOOK_SECRET: ${GITEA_WEBHOOK_SECRET:-}
+      GITEA_API_TOKEN: ${GITEA_API_TOKEN:-}
+      GATEKEEPER_ENABLED: ${GATEKEEPER_ENABLED:-true}
     volumes:
       - openbao_init:/openbao/init:ro
     ports: