refactor: unify JwtOptions schema with obsidian-mcp + simplify deploy

- Config/JwtOptions: flatten SigningKeyCurrent/Previous into nested
  SigningKey { Current, Previous } class to match obsidian-mcp shape.
  Both services now bind the same env var pattern (Jwt__SigningKey__Current),
  removing the schema fork that caused gitea-mcp to start with empty keys
  when compose used the obsidian-mcp convention.
- Auth/JwtBearerSetup, appsettings.json, README: follow rename.
- .gitea/workflows/build-image.yml: deploy job no longer clones nas-infra
  to a temp dir (which lacks the gitignored .env.shared). Now cd directly
  into /volume1/docker/compose/gitea-mcp, exposed by gitea-runner mount.

README.md

@@ -66,8 +66,8 @@ All tools require a valid JWT with `scope=read:gitea` issued by nas-auth.
 | `Gitea__MaxFileBytes` | `1048576` | Max file read size in bytes (1MB) |
 | `Jwt__Issuer` | `https://auth.zhengchentao.win` | Expected JWT issuer |
 | `Jwt__Audience` | `gitea` | Expected JWT audience |
-| `Jwt__SigningKeyCurrent` | *(required)* | HS256 signing key (shared with nas-auth) |
-| `Jwt__SigningKeyPrevious` | *(empty)* | Previous key for rotation window |
+| `Jwt__SigningKey__Current` | *(required)* | HS256 signing key (shared with nas-auth) |
+| `Jwt__SigningKey__Previous` | *(empty)* | Previous key for rotation window |
 | `ASPNETCORE_ENVIRONMENT` | `Production` | Use `Development` locally |
 
 All secrets come from `/volume1/docker/compose/.env.shared` on NAS — never hardcode them.
@@ -95,7 +95,7 @@ dotnet user-jwts create \
   --claim scope=read:gitea
 ```
 
-Or use [jwt.io](https://jwt.io) with alg=HS256 and the key from `Jwt:SigningKeyCurrent`.
+Or use [jwt.io](https://jwt.io) with alg=HS256 and the key from `Jwt:SigningKey:Current`.
 
 ### 3. Test with MCP Inspector
 
@@ -147,7 +147,7 @@ services:
       - Gitea__RepoBlacklist=
       - Jwt__Issuer=https://auth.zhengchentao.win
       - Jwt__Audience=gitea
-      - Jwt__SigningKeyCurrent=${JWT_SIGNING_KEY_CURRENT}
+      - Jwt__SigningKey__Current=${JWT_SIGNING_KEY_CURRENT}
       - TZ=Asia/Shanghai
     env_file:
       - ../.env.shared