feat: add --tools flag to filter exposed MCP tools (#167)

Adds `-O`/`-tools` CLI flag and `GITEA_TOOLS` environment variable
accepting a comma-separated list of tool names. When set, only the
listed tools are exposed to MCP clients, which lets AI agents trim
their tool context. Composes with `--read-only`. Unknown names are
logged at startup so typos surface instead of failing silently.

Co-Authored-By: silverwind <me@silverwind.io>
Co-Authored-By: Claude (Opus 4.7) <noreply@anthropic.com>

pkg/flag/flag.go

@@ -7,7 +7,8 @@ var (
 	Version string
 	Mode    string
 
-	Insecure bool
-	ReadOnly bool
-	Debug    bool
+	Insecure     bool
+	ReadOnly     bool
+	Debug        bool
+	AllowedTools map[string]struct{}
 )