feat(gitea-mcp): serveur MCP Gitea officiel (gitea.com/gitea/gitea-mcp v1.6.0)

- buildGoModule, transport stdio, GITEA_ACCESS_TOKEN_FILE (secret jamais en clair)
- v1.6.0 (pas la dernière) : v1.7.0 exige go >= 1.27, non fourni par nixpkgs 26.05
- secret PAT dans secrets/gitea-mcp.yml (sops)

secrets/gitea-mcp.yml

@@ -0,0 +1,16 @@
+gitea_mcp_pat: ENC[AES256_GCM,data:p5gFQhEgtyZsOJyxYdtzjC1cT8UGAzRN4mOiLxyvU9glGw==,iv:HSIcj30c1PLikKw8ONWVpS5sfGcm0y1pYxKpTl2AJik=,tag:+AM95hMmtWiDsRd8qMi/PQ==,type:str]
+sops:
+    age:
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA4RU5jWDRSYzdZSW9GbGFY
+            VHMydFVkcGQrbVFqQzJlQXhWbm13U1plSWtjCnZpMGNaTFJkUjl1VFFpak42eFU2
+            R2ZlYzVZbDl3TE84QlpMMFU3aDkyeUUKLS0tIFIxeGZSZ3haT05rWjZyenRlbzJV
+            SVV6cnFlWC9jTDU5MDZtcWE4UkJ3Rm8K2cY8xMaLK6s9D5Idf6dYRVEoHDj0CaLz
+            zeZKFZ1GmdHl0vHjruReoQa8lbfCMF3VRUZoS0u6UGXTfuHnASO9vQ==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age1usm3v0ugducrzcwud60dda7xfnj49fdhecj7kcsfm7dzwzrzeyqq2jc2hm
+    lastmodified: "2026-09-27T21:57:59Z"
+    mac: ENC[AES256_GCM,data:mMdypZYZK3xWDZ4JB9+S1Ho2IPcWy4K+p8jZtB5PmJYKWn86PjS7yHBlzpkmLFFde6TFOwWuVo5SLKgKQJVUe/7MPXnrlF3KVqixLt6KbYi9kn6M9qIE68zmAaYWfZ2pMvXjn2LG06CqSKaVHV2sjiyOGDSJ0o6wuifzAzVlBBU=,iv:0LkK1pORCNTEAqGeBRK6FY7qXch6STRHmDW4xrQJMhc=,tag:rKYgOaYkPtPh3UkBG9THcA==,type:str]
+    unencrypted_suffix: _unencrypted
+    version: 3.13.3

services/gitea-mcp/default.nix

@@ -0,0 +1,49 @@
+# services/gitea-mcp/default.nix
+# Serveur MCP Gitea officiel (gitea.com/gitea/gitea-mcp) pour hermes.
+# Transport stdio : hermes spawn le subprocess (mcpServers dans
+# services/hermes/default.nix, command = "gitea-mcp").
+#
+# Version v1.6.0 et pas la dernière (v1.7.0) : v1.7.0 exige go >= 1.27 alors que
+# la nixpkgs épinglée (26.05) fournit go 1.26.7 -> échec du build des modules.
+# v1.6.0 exige go 1.26.0, donc compatible, ET supporte GITEA_ACCESS_TOKEN_FILE
+# (le secret sops est lu par le binaire, jamais passé en clair dans l'env).
+#
+# Auth : Personal Access Token Gitea (Settings -> Applications -> Generate Token,
+# scopes: repo, admin:org, admin:user, notification, user, write:package, read:package).
+# Le token vit dans secrets/gitea-mcp.yml (sops, clé gitea_mcp_pat).
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}: let
+  version = "1.6.0";
+  gitea-mcp = pkgs.buildGoModule {
+    pname = "gitea-mcp";
+    inherit version;
+    src = pkgs.fetchzip {
+      url = "https://gitea.com/gitea/gitea-mcp/archive/v${version}.tar.gz";
+      hash = "sha256-A4HqHEicIdq7L/hmQ+tWeTJWnVscSIfCn3ku1dKSCkY=";
+    };
+    vendorHash = "sha256-BYHcV5WSklGqdeTN7S2AMtscJDCA/8n1gEOgLzr9Gmk=";
+    subPackages = ["."];
+    ldflags = ["-s" "-w"];
+    meta = with pkgs.lib; {
+      description = "Gitea Model Context Protocol server";
+      homepage = "https://gitea.com/gitea/gitea-mcp";
+      license = licenses.mit;
+      mainProgram = "gitea-mcp";
+    };
+  };
+in {
+  # Le binaire sur le PATH (c'est ce que référence mcpServers.gitea.command)
+  environment.systemPackages = [gitea-mcp];
+
+  # Secret PAT Gitea (créé dans Gitea -> Settings -> Applications)
+  sops.secrets."gitea-mcp/pat" = {
+    key = "gitea_mcp_pat";
+    sopsFile = ../../secrets/gitea-mcp.yml;
+    owner = "hermes";
+    mode = "0400";
+  };
+}