Implement v1 URL shortener (Bearer API, public 302, landing, CI) (#2)

## Summary

- Standalone Django 6 shortener: Bearer `/api/links/` (create/list/detail/disable) and public `GET /<code>` 302
- Host split, target-host allowlist, named rotatable tokens; `short_url` from `PUBLIC_SHORT_URL`
- Landing page, DEBUG-only `/debug/` mint form, Django admin
- Docker/compose (host **8005**), Gitea CI like monica_site (PR tests, beta on merge, prod button)
- Caller contract in `API.md`

Closes #1. Infra follow-up: [server-infra#22](ai_ml_operations/server-infra#22).

## Test plan
- [ ] `cd site && uv run python manage.py test`
- [ ] `docker compose up --build` → http://127.0.0.1:8005/
- [ ] `POST /api/links/` with `Bearer monica:dev-only-token` → 201
- [ ] `GET /<code>` → 302 to allowlisted https URL
- [ ] No Bearer → 401; non-allowlisted host → 400
- [ ] `/debug/` only when `DEBUG=true`

Reviewed-on: #2

site/links/forms.py

@@ -0,0 +1,21 @@
+from django import forms
+
+from links.services import ValidationError, validate_target_url
+
+
+class DebugCreateForm(forms.Form):
+    target_url = forms.URLField(
+        label="Target URL",
+        widget=forms.URLInput(
+            attrs={"placeholder": "https://mkdrealtor.com/listings/oak-st", "autofocus": True}
+        ),
+    )
+    title = forms.CharField(label="Title", required=False, max_length=200)
+    external_ref = forms.CharField(label="External ref", required=False, max_length=64)
+
+    def clean_target_url(self) -> str:
+        raw = self.cleaned_data["target_url"]
+        try:
+            return validate_target_url(raw)
+        except ValidationError as exc:
+            raise forms.ValidationError(str(exc)) from exc