Add cmd/ entrypoints, fix auth, deploy to K8s

- cmd/indexer/main.go: CLI with full/repo/webhook/search subcommands
  Clones repos via Gitea API, walks files, indexes to MeiliSearch.
  Webhook HTTP server on :8080 for real-time push reindexing.
- cmd/mcp-server/main.go: MCP stdio server wiring meili + mcp packages
- internal/gitea/client.go: Use Authorization header instead of ?token=
  query param (required by current Gitea API)
- k8s/indexer-cronjob.yaml: Remove embedded secret (foot-gun),
  pin image to v1.0.1, add imagePullPolicy: IfNotPresent
- .gitignore: Anchor binary patterns to root so cmd/ dirs aren't ignored

Deployed: 1,003 documents from 39 repos indexed in 83s.
Global Gitea webhook configured for real-time reindexing.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

k8s/indexer-cronjob.yaml

@@ -1,12 +1,7 @@
-apiVersion: v1
-kind: Secret
-metadata:
-  name: indexer-secret
-  namespace: gitea-search
-type: Opaque
-stringData:
-  gitea-token: "CHANGE-ME"
-  webhook-secret: "CHANGE-ME"
+# Secret 'indexer-secret' must be created separately with real values:
+#   kubectl -n gitea-search create secret generic indexer-secret \
+#     --from-literal=gitea-token="<real-token>" \
+#     --from-literal=webhook-secret="$(openssl rand -hex 32)"
 ---
 apiVersion: batch/v1
 kind: CronJob
@@ -27,7 +22,8 @@ spec:
           restartPolicy: OnFailure
           containers:
             - name: indexer
-              image: gitea.rspworks.tech/rpert/gitea-search:latest
+              image: gitea.rspworks.tech/rpert/gitea-search:v1.0.1
+              imagePullPolicy: IfNotPresent
               command: ["indexer", "full"]
               env:
                 - name: GITEA_URL
@@ -74,7 +70,8 @@ spec:
     spec:
       containers:
         - name: webhook
-          image: gitea.rspworks.tech/rpert/gitea-search:latest
+          image: gitea.rspworks.tech/rpert/gitea-search:v1.0.1
+          imagePullPolicy: IfNotPresent
           command: ["indexer", "webhook"]
           ports:
             - containerPort: 8080