Monorepo: Gitea CI, docs, auth/sync, backend APIs, gitignore

- Add Gitea Actions workflow; point README to gitea.d-bis.org/Sankofa_Phoenix/SMOA
- Expand .gitignore for Spring H2 data, secrets, Kotlin .kotlin/, tooling
- Track docs/api/generated ReDoc bundle; refresh api docs README
- Android: network/auth/sync, UI shell, tests; backend credentials/integrity APIs
- Docs, scripts (generate-api-docs), modules and core updates

Made-with: Cursor

docs/api/api-specification.yaml

@@ -3,7 +3,13 @@ info:
   title: SMOA API Specification
   description: |
     API specification for Secure Mobile Operations Application (SMOA).
-    This specification documents all internal and external APIs.
+
+    **Authoritative mobile sync contract:** the running backend’s OpenAPI document
+    (`/v3/api-docs` via springdoc) matches Kotlin DTOs in `backend/src/main/kotlin/.../api/dto`.
+    This YAML is a **design reference**; prefer springdoc export in CI if drift is detected.
+
+    Credential **sync** uses `CredentialSyncRequest` (POST `/api/v1/sync/credential`), not the
+    legacy `Credential` resource shape below where paths differ.
   version: 1.0.0
   contact:
     name: SMOA Development Team
@@ -344,7 +350,23 @@ components:
           type: string
         type:
           type: string
-          enum: [id, badge, license, permit, other]
+          description: >
+            Canonical values align with Complete Credential CredentialRef.domain plus
+            SMOA barcode templates (see docs/reference/IDENTITY-TEMPLATE-ALIGNMENT.md).
+          enum:
+            - piv_pki
+            - payment
+            - nfc_access
+            - mobile
+            - icao9303_mrtd
+            - aamva_dlid
+            - mil_std_129
+            - agency_badge
+            - id
+            - badge
+            - license
+            - permit
+            - other
         title:
           type: string
         issuer:
@@ -382,6 +404,39 @@ components:
           type: string
           format: date
 
+    CredentialSyncRequest:
+      type: object
+      required:
+        - credentialId
+        - holderId
+        - credentialType
+      description: >
+        Mobile sync body for POST /api/v1/sync/credential. credentialType matches
+        SmoaCredentialType (canonical + legacy). payload is optional JSON validated
+        per docs/schemas when issuing ICAO/AAMVA/military document types.
+      properties:
+        credentialId:
+          type: string
+        holderId:
+          type: string
+        credentialType:
+          type: string
+          pattern: ^(piv_pki|payment|nfc_access|mobile|icao9303_mrtd|aamva_dlid|mil_std_129|agency_badge|id|badge|license|permit|other)$
+        issuer:
+          type: string
+        issuedAt:
+          type: integer
+          format: int64
+        expiresAt:
+          type: integer
+          format: int64
+        payload:
+          type: object
+          additionalProperties: true
+        clientUpdatedAt:
+          type: integer
+          format: int64
+
     Order:
       type: object
       properties: