Make the config file the only home for settings

With no production instance yet, there is no reason to carry two ways
of configuring the agent. Every environment variable that duplicated a
config key is gone; the environment now supplies only the secrets the
file references by ${…}, plus NISSE_CONFIG and NISSE_ENV to find the
files.

- AgentConfig loads from a file (load, from_file) or a parsed tree
  (from_tree, for tests); a missing file is an error naming the example
- The from_env constructors on LiteLLMClient, AnthropicPassthroughClient,
  GiteaClient, MatrixConfig and RoleMap are removed, with the env
  reading for max output tokens; clients take their settings from config
- The live integration tests share a committed agent config,
  tests/integration/nisse-test.yaml, aimed at test resources, and one
  conftest that loads it and builds clients. NISSE_LIVE_PLANNER_MODEL
  becomes its planner role; NISSE_CAPABILITY_MODELS stays as a per-run
  switch
- A missing secret now fails the live tests instead of skipping them
- CI passes only the three tokens
- .env.example is secrets only; spec A5 says config comes from the file

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

tests/integration/test_matrix_live.py

@@ -1,36 +1,14 @@
 """Live smoke test against the real homeserver, bound strictly to the
-dedicated test room (never the production room).
+dedicated test room that nisse-test.yaml names (never the production room)."""
 
-NISSE_MATRIX_HOMESERVER alone decides whether this runs: if it is set, the
-live path is expected to work, and anything else missing is a *failure*, not
-a skip. A half-configured environment must not pass quietly as a skip — that
-is how a broken CI credential hides."""
-
-import os
 import uuid
-from pathlib import Path
 
 import pytest
 
-from nisse_dev.envfile import load_env_file
+from nisse_dev.config import AgentConfig
 from nisse_dev.matrix import MatrixConfig, MatrixTransport
 
-load_env_file(Path(__file__).resolve().parents[2] / ".env")
-
-SENTINEL = "NISSE_MATRIX_HOMESERVER"
-ALSO_REQUIRED = (
-    "NISSE_MATRIX_USER_ID",
-    "NISSE_MATRIX_TOKEN",
-    "NISSE_MATRIX_TEST_ROOM_ID",
-)
-
-pytestmark = [
-    pytest.mark.integration,
-    pytest.mark.skipif(
-        not os.environ.get(SENTINEL),
-        reason=f"no live homeserver configured ({SENTINEL} unset)",
-    ),
-]
+pytestmark = pytest.mark.integration
 
 
 def _assert_testing_identity(transport: MatrixTransport, config: MatrixConfig) -> None:
@@ -46,7 +24,7 @@ def _assert_testing_identity(transport: MatrixTransport, config: MatrixConfig) -
     whoami.raise_for_status()
     actual = whoami.json()["user_id"]
     assert actual == config.user_id, (
-        f"NISSE_MATRIX_USER_ID is {config.user_id} but the token belongs to "
+        f"matrix.user_id is {config.user_id} but the token belongs to "
         f"{actual}; the self-message filter would not match"
     )
     assert "testing" in actual, (
@@ -54,13 +32,8 @@ def _assert_testing_identity(transport: MatrixTransport, config: MatrixConfig) -
     )
 
 
-def test_send_lands_in_test_room() -> None:
-    missing = [var for var in ALSO_REQUIRED if not os.environ.get(var)]
-    assert not missing, (
-        f"{SENTINEL} is set, so the live Matrix path is expected to work, "
-        f"but these are missing: {', '.join(missing)}"
-    )
-    config = MatrixConfig.from_env(room_var="NISSE_MATRIX_TEST_ROOM_ID")
+def test_send_lands_in_test_room(live_config: AgentConfig) -> None:
+    config = live_config.matrix
     marker = f"transport smoke test {uuid.uuid4().hex}"
     transport = MatrixTransport(config)
     try: