sciagent code + Gitea Actions CI/CD

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

be0/.env.example

@@ -0,0 +1,29 @@
+# Copy to .env and adjust. docker-compose sets these for the be0 service when using the repo stack.
+INITIATIVE_DATABASE_URL=postgresql+asyncpg://initiative:initiative_secret@localhost:15432/initiatives
+
+# S3 / MinIO — server-to-server (API → object store)
+S3_ENDPOINT_URL=http://localhost:19000
+S3_ACCESS_KEY=minio_user
+S3_SECRET_KEY=minio_password
+S3_BUCKET_ATTACHMENTS=initiative-attachments
+S3_BUCKET_EXPORTS=initiative-exports
+S3_BUCKET_QUARANTINE=initiative-quarantine
+
+# Optional: HTTPS base for presigned URLs (must match public MinIO TLS host; see docs/minio-behind-https.md)
+# S3_PUBLIC_ENDPOINT_URL=https://minio-api.example.com
+
+# Optional: comma-separated extra browser origins for CORS (merged with localhost defaults in main.py).
+# In Docker dev stack, docker-compose.yml can set this; production compose adds your public UI URL automatically.
+# CORS_ORIGINS=http://YOUR_LAN_IP:8081
+
+# Local Python runs may load this file; Docker Compose uses the repo-root `.env` for ${SMTP_*} → be0.
+# Password reset email (same SMTP block as `.env.example` beside docker-compose for dev stack.)
+# OTP + reset use src/auth_mail.py: set SMTP_* for Option A or AUTH_MAIL_LOG_ONLY=1 locally.
+# AUTH_MAIL_LOG_ONLY=1
+# AUTH_PUBLIC_WEB_ORIGIN=http://localhost:8081
+# SMTP_HOST=smtp.example.com
+# SMTP_PORT=587
+# SMTP_USER=
+# SMTP_PASSWORD=
+# AUTH_MAIL_FROM=noreply@example.com
+# SMTP_USE_TLS=1