Require Gitea login to write GPX data; IPv6-capable bind

Upload/delete/move/create-folder now require logging in via Gitea
OAuth2 (only MAPTOOL_ALLOWED_GITEA_USER is granted write access);
reading stays public. Deploy secrets (session secret, OAuth2 client
credentials, allowed user) are written to .env from Gitea Actions
repo secrets on every deploy instead of living on the server by hand.

Also switch the container's bind address to "[::]" (dual-stack) so
the app is reachable over IPv6, not just IPv4.

docs/architecture.adoc

@@ -239,5 +239,32 @@ Online/Offline) with no extra re-add handling needed.
 
 == Networking
 
-The Sinatra server only binds to `127.0.0.1`. It is not meant to be
-reachable from other machines.
+By default (local dev) the Sinatra server only binds to `127.0.0.1`
+and isn't reachable from other machines. The deployed instance is an
+exception — see `docs/deployment.adoc` for `BIND_HOST` and how it's
+exposed via Docker/nginx as `map.priesol.net`.
+
+== Authentication
+
+The GPX store's read endpoints (viewing the map, the folder tree,
+individual files) are public — anyone with the URL can look. Its write
+endpoints (`POST /api/gpx`, `POST /api/gpx/folder`, `DELETE
+/api/gpx/file/*`, `DELETE /api/gpx/folder/*`, `POST /api/gpx/move`)
+require login, guarded by `require_login!` in `app.rb`.
+
+Login delegates to the Gitea instance at `git.priesol.net` via OAuth2
+(`GET /login` redirects to Gitea's authorize endpoint, `GET
+/auth/callback` exchanges the code and fetches
+`/api/v1/user`) rather than maintaining a separate local
+username/password — there's already an account to reuse, and it keeps
+credential storage (password hash, resets, ...) out of this app
+entirely. Successfully authenticating with Gitea is not by itself
+enough to write, though — the callback also checks the returned
+`login` against `MAPTOOL_ALLOWED_GITEA_USER`, so registering (or
+already having) any other account on that Gitea instance doesn't grant
+access here.
+
+Session state is a signed cookie (`Rack::Session::Cookie`, `secure`
+in production, `httponly`, `same_site: lax`) keyed off
+`SESSION_SECRET` — see `docs/deployment.adoc` for where that and the
+OAuth2 client id/secret live (not committed to the repo).