Implement v1 URL shortener (Bearer API, public 302, landing, CI) (#2)

## Summary

- Standalone Django 6 shortener: Bearer `/api/links/` (create/list/detail/disable) and public `GET /<code>` 302
- Host split, target-host allowlist, named rotatable tokens; `short_url` from `PUBLIC_SHORT_URL`
- Landing page, DEBUG-only `/debug/` mint form, Django admin
- Docker/compose (host **8005**), Gitea CI like monica_site (PR tests, beta on merge, prod button)
- Caller contract in `API.md`

Closes #1. Infra follow-up: [server-infra#22](ai_ml_operations/server-infra#22).

## Test plan
- [ ] `cd site && uv run python manage.py test`
- [ ] `docker compose up --build` → http://127.0.0.1:8005/
- [ ] `POST /api/links/` with `Bearer monica:dev-only-token` → 201
- [ ] `GET /<code>` → 302 to allowlisted https URL
- [ ] No Bearer → 401; non-allowlisted host → 400
- [ ] `/debug/` only when `DEBUG=true`

Reviewed-on: #2

site/links/templates/links/debug_create.html

@@ -0,0 +1,35 @@
+{% extends "core/base.html" %}
+{% block title %}Create short link · debug{% endblock %}
+{% block content %}
+  <p class="eyebrow">Debug only</p>
+  <h1>Create a short link</h1>
+  <p class="lede">Uses the same allowlist as the API. Not served when <code>DEBUG</code> is false.</p>
+
+  {% if messages %}
+  <ul class="messages">
+    {% for message in messages %}<li>{{ message }}</li>{% endfor %}
+  </ul>
+  {% endif %}
+
+  {% if created_link %}
+  <div class="result">
+    <p>Short URL</p>
+    <p><code>{{ created_link.public_short_url }}</code></p>
+    <p>Target: {{ created_link.target_url }}</p>
+    <a class="btn" href="{{ created_link.public_short_url }}">Open</a>
+  </div>
+  {% endif %}
+
+  <form method="post" action="{% url 'debug-create' %}">
+    {% csrf_token %}
+    {{ form.non_field_errors }}
+    {% for field in form %}
+    <label>
+      {{ field.label }}
+      {{ field }}
+      {% if field.errors %}<span class="error">{{ field.errors|striptags }}</span>{% endif %}
+    </label>
+    {% endfor %}
+    <button type="submit">Mint</button>
+  </form>
+{% endblock %}