rescue(ms-gate-001): preserve uncommitted gatekeeper WIP found in canonical clone (Q19 O1, Jason 2026-08-25)

Gatekeeper module (Gitea PR-webhook -> pending merges), AddPendingMerges
migration, vitest-runner, webhook edits, compose/CI/env/docs touches.
Applied to the tree in a single event 2026-08-23 18:45, author unknown.
Base main@32896770 (2026-03-09). Rescued verbatim for remediation per
board row; no functional review implied.

docs/1-getting-started/3-configuration/1-environment.md

@@ -94,6 +94,21 @@ OIDC_REDIRECT_URI=http://localhost:3001/auth/oauth2/callback/authentik
 
 See [Authentik Setup](2-authentik.md) for complete OIDC configuration.
 
+## Webhooks and Merge Automation
+
+```bash
+# Gitea webhook validation secret for /api/gatekeeper/webhook/gitea
+GITEA_WEBHOOK_SECRET=your-random-webhook-secret
+
+# Personal access token used by Gatekeeper to comment on and merge PRs
+GITEA_API_TOKEN=your-gitea-api-token
+
+# Master switch for the Gatekeeper auto-merge workflow
+GATEKEEPER_ENABLED=true
+```
+
+Use a dedicated Gitea token with the minimum repository scope needed to comment on pull requests and perform merges.
+
 ## Cache and Storage
 
 ### Valkey (Redis-compatible)