Add initial implementation of gitea-mcp-forward-auth microservice

- Create build and release workflows for CI/CD
- Implement Dockerfile for multi-stage builds
- Add core authentication logic with token validation
- Include HTTP handler for authorization checks
- Set up Kubernetes deployment and service manifests
- Update README with usage instructions and configuration details

internal/auth/http.go

@@ -0,0 +1,65 @@
+package auth
+
+import (
+	"log/slog"
+	"net/http"
+)
+
+type Handler struct {
+	validator *Validator
+	logger    *slog.Logger
+}
+
+func NewHandler(validator *Validator, logger *slog.Logger) *Handler {
+	if logger == nil {
+		logger = slog.Default()
+	}
+	return &Handler{
+		validator: validator,
+		logger:    logger,
+	}
+}
+
+func (h *Handler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
+	if r.URL.Path == "/healthz" {
+		w.WriteHeader(http.StatusOK)
+		_, _ = w.Write([]byte("ok"))
+		return
+	}
+
+	authHeader := r.Header.Get("Authorization")
+	token, err := ParseBearerToken(authHeader)
+	if err != nil {
+		h.logAttempt(r, "denied", "auth_header_invalid", "")
+		h.unauthorized(w)
+		return
+	}
+
+	fingerprint := TokenFingerprint(token)
+	if !h.validator.IsValid(token) {
+		h.logAttempt(r, "denied", "token_invalid", fingerprint)
+		h.unauthorized(w)
+		return
+	}
+
+	h.logAttempt(r, "allowed", "token_valid", fingerprint)
+	w.WriteHeader(http.StatusOK)
+}
+
+func (h *Handler) unauthorized(w http.ResponseWriter) {
+	w.Header().Set("WWW-Authenticate", "Bearer")
+	w.WriteHeader(http.StatusUnauthorized)
+}
+
+func (h *Handler) logAttempt(r *http.Request, result, reason, fingerprint string) {
+	attrs := []any{
+		"result", result,
+		"reason", reason,
+		"method", r.Method,
+		"path", r.URL.Path,
+	}
+	if fingerprint != "" {
+		attrs = append(attrs, "token_fingerprint", fingerprint)
+	}
+	h.logger.Info("auth attempt", attrs...)
+}