feat(auth): fall back to GITEA_MCP_DEFAULT_TOKEN when no Bearer header

claude.ai connectors call the server with no Authorization header (confirmed
via request logging). Add a configurable default Gitea PAT so unauthenticated
clients (like claude.ai) can still reach the server.

Claude Code continues to pass per-request PATs; defaultToken="" preserves
the existing strict behaviour when the env var is unset.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

cmd/gitea-mcp/main.go

@@ -73,7 +73,7 @@ func main() {
 
 	mux := http.NewServeMux()
 	mux.Handle("/mcp", logReq(mcp.OriginAllowlist(cfg.OriginAllowlist)(
-		auth.BearerMiddleware(cfg.GiteaBaseURL,
+		auth.BearerMiddleware(cfg.GiteaBaseURL, cfg.DefaultToken,
 			auth.CallerMiddleware(mcpSrv),
 		)),
 	))