Make the config file the only home for settings

With no production instance yet, there is no reason to carry two ways
of configuring the agent. Every environment variable that duplicated a
config key is gone; the environment now supplies only the secrets the
file references by ${…}, plus NISSE_CONFIG and NISSE_ENV to find the
files.

- AgentConfig loads from a file (load, from_file) or a parsed tree
  (from_tree, for tests); a missing file is an error naming the example
- The from_env constructors on LiteLLMClient, AnthropicPassthroughClient,
  GiteaClient, MatrixConfig and RoleMap are removed, with the env
  reading for max output tokens; clients take their settings from config
- The live integration tests share a committed agent config,
  tests/integration/nisse-test.yaml, aimed at test resources, and one
  conftest that loads it and builds clients. NISSE_LIVE_PLANNER_MODEL
  becomes its planner role; NISSE_CAPABILITY_MODELS stays as a per-run
  switch
- A missing secret now fails the live tests instead of skipping them
- CI passes only the three tokens
- .env.example is secrets only; spec A5 says config comes from the file

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

tests/integration/conftest.py

@@ -0,0 +1,62 @@
+"""Shared setup for the live integration tests.
+
+They run against real services, configured by nisse-test.yaml beside this
+file: an ordinary agent config aimed at test resources, committed to the
+repository. Its secrets are ${…} references, supplied by CI as environment
+variables and locally by .env at the repository root.
+
+A missing secret is a failure, not a skip. A half-configured environment must
+not pass quietly as a skip: that is how a broken CI credential hides.
+"""
+
+from pathlib import Path
+
+import pytest
+
+from nisse_dev.config import AgentConfig
+from nisse_dev.envfile import load_env_file
+from nisse_dev.gitea import GiteaClient
+from nisse_dev.llm import AnthropicPassthroughClient, LiteLLMClient
+
+REPO = Path(__file__).resolve().parents[2]
+TEST_CONFIG = Path(__file__).parent / "nisse-test.yaml"
+
+# At import, so per-run switches such as NISSE_CAPABILITY_MODELS can be set
+# in .env too. Real environment variables win over the file.
+load_env_file(REPO / ".env")
+
+
+@pytest.fixture(scope="session")
+def live_config() -> AgentConfig:
+    return AgentConfig.from_file(TEST_CONFIG)
+
+
+@pytest.fixture
+def live_model(live_config: AgentConfig) -> str:
+    """The model the live tests plan, execute and delegate with."""
+    return live_config.roles.planner
+
+
+@pytest.fixture
+def litellm(live_config: AgentConfig) -> LiteLLMClient:
+    return LiteLLMClient(
+        live_config.llm_base_url,
+        live_config.llm_token,
+        max_tokens=live_config.max_output_tokens,
+    )
+
+
+@pytest.fixture
+def passthrough(live_config: AgentConfig) -> AnthropicPassthroughClient:
+    return AnthropicPassthroughClient(
+        live_config.llm_base_url,
+        live_config.llm_token,
+        max_tokens=live_config.max_output_tokens,
+    )
+
+
+@pytest.fixture
+def gitea(live_config: AgentConfig) -> GiteaClient:
+    client = GiteaClient(live_config.gitea_url, live_config.gitea_token)
+    yield client
+    client.close()