Require Gitea login to write GPX data; IPv6-capable bind

Upload/delete/move/create-folder now require logging in via Gitea
OAuth2 (only MAPTOOL_ALLOWED_GITEA_USER is granted write access);
reading stays public. Deploy secrets (session secret, OAuth2 client
credentials, allowed user) are written to .env from Gitea Actions
repo secrets on every deploy instead of living on the server by hand.

Also switch the container's bind address to "[::]" (dual-stack) so
the app is reachable over IPv6, not just IPv4.

docs/deployment.adoc

@@ -68,6 +68,40 @@ the deployed container specifically; Docker's own port publishing
 (`ports:` in the compose file) is the network boundary there instead
 of Puma's bind address.
 
+== Secrets (`.env`)
+
+`docker-compose.yaml` reads `SESSION_SECRET`, `GITEA_OAUTH_CLIENT_ID`,
+`GITEA_OAUTH_CLIENT_SECRET` and `MAPTOOL_ALLOWED_GITEA_USER` from the
+environment (see `docs/architecture.adoc` for what they're for) —
+docker compose loads these automatically from a `.env` file next to
+`docker-compose.yaml`, i.e. `/srv/docker/maptool/.env`. That file is
+gitignored and dockerignored on purpose: nothing here ever puts
+secrets in the repository or a built image layer.
+
+It's not created by hand on the server — the deploy job's "Write
+.env" step regenerates it on every deploy from repo-level Gitea
+Actions secrets (*Settings → Actions → Secrets*): `SESSION_SECRET`,
+`OAUTH_CLIENT_ID`, `OAUTH_CLIENT_SECRET`, `MAPTOOL_ALLOWED_GITEA_USER`.
+The OAuth2 ones aren't named `GITEA_OAUTH_CLIENT_*` to match the `.env`
+var names 1:1 — Gitea rejects secret names starting with `GITEA_` or
+`GITHUB_` as reserved — but the workflow step maps them to the right
+`.env` var names regardless. Gitea masks secret values in the job log
+automatically. Set these once in the repo settings and every deploy
+since keeps `.env` in sync — no server-side step needed beyond the
+first-time OAuth2 application registration below.
+
+`SESSION_SECRET` must stay the same value across deploys (regenerating
+it every push would silently log everyone out every time `main`
+changes) — generate it once (`openssl rand -hex 32`) and store that
+same value as the secret from then on, don't regenerate per-deploy.
+
+Register the OAuth2 application on the Gitea side (as the
+`MAPTOOL_ALLOWED_GITEA_USER` account): *Settings → Applications →
+Manage OAuth2 Applications → Create a new OAuth2 Application*, with
+redirect URI `https://map.priesol.net/auth/callback`. That gives you
+the client id/secret to store as the two `GITEA_OAUTH_*` secrets
+above.
+
 == CI deploy job
 
 `.gitea/workflows/ci.yml`'s `deploy` job runs after `check` passes, only