fix(ci): complete gitea→git rename + hadolint SC suppression

- cfg.services.gitea → cfg.services.git in api/clients/gitea,
  api/auth/provision, api/auth/deploy (stack.toml already had the
  key as `git` but code still referenced `gitea` → AttributeError
  in all 3 CI pipelines)
- .hadolint.yaml: suppress SC2015 + SC2012 (info-level shellcheck
  findings in notebooks.Dockerfile that the hadolint-action treats
  as failures)

.hadolint.yaml

@@ -4,3 +4,5 @@ ignored:
   - DL3007   # Using latest tag (acceptable for uv COPY --from)
   - DL3008   # Pin versions in apt-get install (not practical for system deps)
   - DL4006   # Pipe to bash (accepted for zotero installer script)
+  - SC2015   # A && B || C pattern (intentional in multi-stage builds)
+  - SC2012   # ls vs find (ls is fine for known-safe filenames in our builds)

src/api/auth/deploy.py

@@ -75,7 +75,7 @@ def verify_gitea(values: dict[str, str], *, base_url: str = "") -> list[str]:
     if not base_url:
         from conf import cfg
 
-        base_url = f"{cfg.services.gitea}/api/v1"
+        base_url = f"{cfg.services.git}/api/v1"
     token = values.get("GITEA_TOKEN", "")
     if not token:
         errors.append("gitea: no GITEA_TOKEN")

src/api/auth/provision.py

@@ -218,7 +218,7 @@ def provision_gitea(
     if not base_url:
         from conf import cfg
 
-        base_url = f"{cfg.services.gitea}/api/v1"
+        base_url = f"{cfg.services.git}/api/v1"
     pw = values["GITEA_ADMIN_PASSWORD"]
 
     current_token = values.get("GITEA_TOKEN", "")

src/api/clients/gitea/client.py

@@ -26,7 +26,7 @@ class GiteaClient(Client):
         if not base_url:
             from conf import cfg
 
-            base_url = f"{cfg.services.gitea}/api/v1"
+            base_url = f"{cfg.services.git}/api/v1"
         super().__init__(base_url, **kw)
         self._token = token