refactor: unify JwtOptions schema with obsidian-mcp + simplify deploy

- Config/JwtOptions: flatten SigningKeyCurrent/Previous into nested
  SigningKey { Current, Previous } class to match obsidian-mcp shape.
  Both services now bind the same env var pattern (Jwt__SigningKey__Current),
  removing the schema fork that caused gitea-mcp to start with empty keys
  when compose used the obsidian-mcp convention.
- Auth/JwtBearerSetup, appsettings.json, README: follow rename.
- .gitea/workflows/build-image.yml: deploy job no longer clones nas-infra
  to a temp dir (which lacks the gitignored .env.shared). Now cd directly
  into /volume1/docker/compose/gitea-mcp, exposed by gitea-runner mount.

appsettings.json

@@ -17,8 +17,10 @@
   "Jwt": {
     "Issuer": "https://auth.zhengchentao.win",
     "Audience": "gitea",
-    "SigningKeyCurrent": "",
-    "SigningKeyPrevious": ""
+    "SigningKey": {
+      "Current": "",
+      "Previous": ""
+    }
   },
   "Mcp": {
     "OAuthDiscovery": {