…alidation

Add runtime validation of widget parameters in manage_work_item handler
against the detected GitLab instance version and tier before making API calls.

- Add VERSION_RESTRICTED structured error type to error-handler
- Add parameter-to-widget mapping (PARAMETER_WIDGET_MAP) in WidgetAvailability
- Add validateWidgetParams() method that checks version/tier compatibility
- Integrate validation in manage_work_item create/update actions
- Return structured error with required version, detected version, and upgrade hint

Closes #137

- Expand PARAMETER_WIDGET_MAP with premium/ultimate tier entries (weight,
  iterationId, linkedItemIds, healthStatus, startDate, dueDate, color)
- Add tier-restricted validation tests for validateWidgetParams
- Add VERSION_RESTRICTED error throw tests in registry create/update handlers

Empty assigneeIds/labelIds arrays should not trigger widget version
validation on create, since the handler does not send widget input
for empty arrays. Update path keeps validation for empty arrays
because they semantically clear the widget.

…ility-for-versio

…ility-for-versio

… flows (#132)

* feat(cli): add unified setup wizard consolidating init/install/docker flows (#129)

Create `gitlab-mcp setup` command that unifies the three separate wizards
(init, install, docker init) into a single entry point with discovery,
mode selection, tool configuration, and multiple execution flows.

- Add src/cli/setup/ module with types, presets, discovery, wizard, and flows
- Add local-setup, server-setup, configure-existing, and tool-selection flows
- Define 18 tool categories and 6 preset definitions (developer, senior-dev,
  devops, code-reviewer, full-access, readonly)
- Add missing preset YAML files: code-reviewer.yaml, full-access.yaml
- Route `init` as alias to `setup --mode=local`
- Route `docker init` as alias to `setup --mode=server`
- Update cli-utils.ts with setup command and --mode flag parsing
- Add 43 unit tests for presets, discovery, and wizard modules

* refactor(setup): align env vars with config and add category application

- Rename USE_ISSUES/USE_WIKI/etc to USE_WORKITEMS/USE_GITLAB_WIKI/etc
- Rename GITLAB_SCOPE_* to GITLAB_PROJECT_ID/GITLAB_ALLOWED_PROJECT_IDS
- Rename GITLAB_MCP_PRESET to GITLAB_PROFILE
- Rename GITLAB_URL to GITLAB_API_URL in local-setup
- Apply toolConfig env to Docker config in server-setup
- Add applyManualCategories() for manual mode category disabling
- Add failure reporting in configure-existing updateClients
- Replace process.exit(0) with null return in wizard cancel path
- Remove unused skipGitlab option from wizard
- Use manage_repository:fork in code-reviewer profile
- Add unit tests for setup flow modules

* refactor(setup): remove commits mapping, rename scope option, persist env to Docker

- Remove "commits" from CATEGORY_ENV_MAP (browse_commits is always-on core)
- Rename "namespace" scope option to "allowlist" with clearer prompt
- Add environment field to DockerConfig type
- Persist tool config env vars into docker-compose via generateDockerCompose
- Make SetupResult.mode optional for cancel-before-selection path
- Add generateDockerCompose environment tests

* fix(discovery): add docker-compose v1 fallback for compose detection

detectDocker now checks both `docker compose version` (v2) and
`docker-compose --version` (v1) for consistency with docker-utils.

* feat(docker): add native Podman support with container runtime detection

Add container-runtime module that detects Docker or Podman automatically.
When Docker is unavailable, falls back to podman/podman-compose for all
container operations. Centralizes runtime detection with process-level
caching, eliminating duplicated logic in discovery.ts.

* fix(setup): use runtime-aware messages and propagate deployment type

- Pass DEPLOYMENT_TYPE to Docker environment config
- Replace hardcoded "Docker" error messages with runtime label
- Add error field to configure-existing container operation failure

* fix(docker): propagate OAuth secrets to compose and throw on missing compose

- Use config.oauthSessionSecret and config.databaseUrl in compose env
- Throw controlled error in tailLogs when no compose tool detected

* fix(setup): implement deployment types, secure secrets, filter ungated categories

- Exit non-zero from main when setup wizard fails
- Add compose-bundle deployment with bundled postgres service
- Store OAuth secret in .env file (0600) instead of plaintext in compose
- Filter always-on categories from manual tool selection UI
- Add deploymentType field to DockerConfig interface

* fix(docker): require OAuth for postgres, use random password, fix exit code

- docker init now exits non-zero on wizard failure (like init/setup)
- compose-bundle only adds postgres service when oauthEnabled is true
- POSTGRES_PASSWORD uses randomBytes(24) instead of weak fixed default
- Add unit tests for setup subcommand parsing in cli-utils
- Add tests for docker init exit codes in main.entry

* fix(presets): correct tool names for webhooks/integrations, add return guard

- Rename list_webhooks → browse_webhooks in webhooks category
- Rename list_integrations → browse_integrations in integrations category
- Add return after process.exit in docker init to prevent fall-through

Centralize version parsing (major*100+minor) into src/utils/version.ts
and use it in WidgetAvailability, GitLabVersionDetector, and
error-handler. This fixes GitLabVersionDetector incorrectly handling
minor versions >= 10 (e.g., 8.14 was compared as 9.4). Make
VERSION_RESTRICTED error message contextual — only mention the
violated constraint (version, tier, or both). Update PARAMETER_WIDGET_MAP
docstring to clarify planned #135 entries.

…hy constant

- Remove redundant `GitLabTier | "free"` union (GitLabTier already includes "free")
- Hoist tierHierarchy to module-level TIER_HIERARCHY constant (avoid recreation per iteration)
- Fix tierHierarchy type in error-handler from Record<string, number> to Record<GitLabTier, number>

…ility-for-versio

…on utility

- Replace private float-based parseVersion (major + minor/100) with shared
  integer-based utility (major * 100 + minor) from src/utils/version.ts
- Change minVersion type from number to string in ToolRequirement and
  ActionRequirement interfaces for consistency with WidgetAvailability
- Remove duplicate parseVersion method from ToolAvailability class
- Update all test assertions for string-based minVersion values

…ER_HIERARCHY

…ateWidgetParams