refactor: unify JwtOptions schema with obsidian-mcp + simplify deploy

- Config/JwtOptions: flatten SigningKeyCurrent/Previous into nested
  SigningKey { Current, Previous } class to match obsidian-mcp shape.
  Both services now bind the same env var pattern (Jwt__SigningKey__Current),
  removing the schema fork that caused gitea-mcp to start with empty keys
  when compose used the obsidian-mcp convention.
- Auth/JwtBearerSetup, appsettings.json, README: follow rename.
- .gitea/workflows/build-image.yml: deploy job no longer clones nas-infra
  to a temp dir (which lacks the gitignored .env.shared). Now cd directly
  into /volume1/docker/compose/gitea-mcp, exposed by gitea-runner mount.

.gitea/workflows/build-image.yml

@@ -91,7 +91,10 @@ jobs:
     needs: build
     runs-on: ubuntu-latest
     steps:
-      # deploy job 是独立 runner，凭据不跨 job 继承，必须再 login 一次
+      # 不再 clone nas-infra：deploy 直接操作 NAS 上 /volume1/docker/compose/gitea-mcp/。
+      # 该目录由 gitea-runner 挂载暴露给 runner（host 模式 + bind mount）。
+      # .env.shared 也在那一层（../.env.shared），不需要再注入凭据。
+      # nas-infra 的 compose 改动靠 NAS 上手动 `git pull` 同步，不进 CI 链路。
       - name: Login to Gitea Container Registry
         uses: docker/login-action@v3
         with:
@@ -100,26 +103,11 @@ jobs:
           password: ${{ secrets.PACKAGES_TOKEN }}
 
       - name: Pull and restart gitea-mcp
-        env:
-          NAS_INFRA_TOKEN: ${{ secrets.NAS_INFRA_TOKEN }}
         run: |
           set -e
-
-          TMPDIR=$(mktemp -d)
-          trap 'rm -rf "$TMPDIR"' EXIT
-
-          if [ -n "$NAS_INFRA_TOKEN" ]; then
-            CLONE_URL="https://x-access-token:${NAS_INFRA_TOKEN}@git.zhengchentao.win/dev/nas-infra.git"
-          else
-            CLONE_URL="https://git.zhengchentao.win/dev/nas-infra.git"
-          fi
-
-          git clone --depth 1 "$CLONE_URL" "$TMPDIR/nas-infra"
-          cd "$TMPDIR/nas-infra/gitea-mcp"
-
+          cd /volume1/docker/compose/gitea-mcp
           docker compose pull
           docker compose up -d
-
           sleep 3
           docker compose ps
           docker compose logs --tail=30 gitea-mcp