Implement v1 URL shortener (Bearer API, public 302, landing, CI) (#2)

## Summary

- Standalone Django 6 shortener: Bearer `/api/links/` (create/list/detail/disable) and public `GET /<code>` 302
- Host split, target-host allowlist, named rotatable tokens; `short_url` from `PUBLIC_SHORT_URL`
- Landing page, DEBUG-only `/debug/` mint form, Django admin
- Docker/compose (host **8005**), Gitea CI like monica_site (PR tests, beta on merge, prod button)
- Caller contract in `API.md`

Closes #1. Infra follow-up: [server-infra#22](ai_ml_operations/server-infra#22).

## Test plan
- [ ] `cd site && uv run python manage.py test`
- [ ] `docker compose up --build` → http://127.0.0.1:8005/
- [ ] `POST /api/links/` with `Bearer monica:dev-only-token` → 201
- [ ] `GET /<code>` → 302 to allowlisted https URL
- [ ] No Bearer → 401; non-allowlisted host → 400
- [ ] `/debug/` only when `DEBUG=true`

Reviewed-on: #2

site/links/debug_views.py

@@ -0,0 +1,41 @@
+"""DEBUG-only form to mint a short link without curling the API."""
+
+from django.conf import settings
+from django.contrib import messages
+from django.http import Http404
+from django.shortcuts import render
+from django.views.decorators.http import require_http_methods
+
+from links.forms import DebugCreateForm
+from links.services import CodeCollisionError, create_link
+
+
+@require_http_methods(["GET", "POST"])
+def debug_create(request):
+    if not settings.DEBUG:
+        raise Http404()
+
+    form = DebugCreateForm(request.POST or None)
+    created_link = None
+    if request.method == "POST" and form.is_valid():
+        try:
+            created_link, minted = create_link(
+                target_url=form.cleaned_data["target_url"],
+                title=form.cleaned_data.get("title") or "",
+                external_ref=form.cleaned_data.get("external_ref") or "",
+                expires_at=None,
+                token_name="debug",
+            )
+        except CodeCollisionError:
+            form.add_error(None, "Could not allocate a unique code.")
+        else:
+            if minted:
+                messages.success(request, "Short link created.")
+            else:
+                messages.info(request, "Existing active link returned (same URL + ref).")
+
+    return render(
+        request,
+        "links/debug_create.html",
+        {"form": form, "created_link": created_link},
+    )