feat(config): config module with idempotent bootstrap and strict v1 validation (#1)

- scripts/mosaic-config.mjs: bootstrap | validate | env operations
- Exclusive creation (O_EXCL 'wx'); existing config validated, never rewritten
- Strict schema: unknown keys rejected, configVersion===1, backend docker only
- dataRoot guards: absolute, canonical, not root/home/ancestor-of-config
- MOSAIC_CONFIG override for sandboxed tests; exit codes 0/2/3
- scripts/bootstrap.sh: explicit bootstrap entry point

Closes #1

scripts/gitea-api.sh

@@ -0,0 +1,83 @@
+#!/usr/bin/env bash
+# Minimal Gitea API client for this repository.
+#
+# Usage: scripts/gitea-api.sh METHOD api/path [json-body]
+#   e.g. scripts/gitea-api.sh GET repos/mosaicstack/stack-v2/issues
+#
+# Security:
+#   - Reads credentials from ~/secrets/mosaic.gitea.json (or
+#     MOSAIC_GITEA_CREDENTIAL_FILE); file must be 0600, non-symlink.
+#   - Token is passed to curl via a config stream (never argv, never disk,
+#     never stdout/stderr).
+#   - Prints the response body on stdout and "HTTP <code>" on stderr.
+#     Exits nonzero when the API reports an error.
+set -euo pipefail
+
+METHOD="${1:?usage: gitea-api.sh METHOD api/path [json-body]}"
+API_PATH="${2:?missing api/path}"
+API_PATH="${API_PATH#/}"
+BODY="${3:-}"
+
+command -v curl >/dev/null || { echo "gitea-api: curl not found" >&2; exit 1; }
+command -v node >/dev/null || { echo "gitea-api: node not found" >&2; exit 1; }
+
+export MOSAIC_GITEA_CREDENTIAL_FILE="${MOSAIC_GITEA_CREDENTIAL_FILE:-$HOME/secrets/mosaic.gitea.json}"
+
+# Validate credential file; emit only the non-secret base URL on stdout.
+BASE="$(node -e '
+const fs = require("fs");
+const p = process.env.MOSAIC_GITEA_CREDENTIAL_FILE;
+let s;
+try { s = fs.lstatSync(p); } catch { process.exit(3); }
+if (!s.isFile() || s.isSymbolicLink() || (s.mode & 0o077) !== 0) process.exit(3);
+let e;
+try { e = JSON.parse(fs.readFileSync(p, "utf8")).mosaicstack || {}; } catch { process.exit(3); }
+const base = String(e.url || "").replace(/\/+$/, "");
+if (!/^https:\/\/git\.mosaicstack\.dev$/.test(base)) process.exit(3);
+if (typeof e.api_token !== "string" || e.api_token.length === 0) process.exit(3);
+process.stdout.write(base);
+')"
+
+# Repo path from the configured origin remote (never from credentials).
+REMOTE_URL="$(git remote get-url origin)"
+REPO_PATH="${REMOTE_URL#https://git.mosaicstack.dev/}"
+REPO_PATH="${REPO_PATH%.git}"
+
+# curl config stream: auth header via fd, never argv.
+gen_curl_cfg() {
+  node -e '
+const fs = require("fs");
+const e = JSON.parse(fs.readFileSync(process.env.MOSAIC_GITEA_CREDENTIAL_FILE, "utf8")).mosaicstack || {};
+process.stdout.write("header = \"Authorization: token " + e.api_token + "\"\n");
+process.stdout.write("header = \"Content-Type: application/json\"\n");
+'
+}
+
+BODY_FILE=""
+cleanup() { [ -n "$BODY_FILE" ] && rm -f "$BODY_FILE"; }
+trap cleanup EXIT
+if [ -n "$BODY" ]; then
+  BODY_FILE="$(mktemp)"
+  chmod 600 "$BODY_FILE"
+  printf '%s' "$BODY" > "$BODY_FILE"
+fi
+
+URL="$BASE/api/v1/$API_PATH"
+if [ -n "$BODY_FILE" ]; then
+  HTTP_CODE="$(curl -sS -K <(gen_curl_cfg) -o /tmp/gitea-api-response.$$ \
+    -w '%{http_code}' -X "$METHOD" "$URL" --data-binary @"$BODY_FILE")" || {
+    echo "gitea-api: request failed" >&2; exit 1; }
+else
+  HTTP_CODE="$(curl -sS -K <(gen_curl_cfg) -o /tmp/gitea-api-response.$$ \
+    -w '%{http_code}' -X "$METHOD" "$URL")" || {
+    echo "gitea-api: request failed" >&2; exit 1; }
+fi
+
+cat /tmp/gitea-api-response.$$ 2>/dev/null || true
+rm -f /tmp/gitea-api-response.$$
+echo "HTTP $HTTP_CODE" >&2
+
+case "$HTTP_CODE" in
+  2*) exit 0 ;;
+  *) echo "gitea-api: $METHOD $API_PATH failed (HTTP $HTTP_CODE)" >&2; exit 1 ;;
+esac