fix: complete remaining partial issues (#5, #8, #9)

#5 Gateway Trust Model:
- Removed inventory /test endpoint
- Updated docs/trust-model.md with accurate description:
  - Per-user services (trips, fitness) vs gateway-key services clearly separated
  - Known limitations documented (no per-user isolation on shared services)
  - No false claims about per-user auth where it doesn't exist

#8 Dependency Security:
- Workflow reviewed and confirmed sane
- Added .gitea/README.md documenting runner requirement
- Status: repo-side complete, operationally blocked on runner setup

#9 Performance Hardening:
- Budget /transactions/recent: 30s cache (1.1s→41ms on repeat)
- Budget /uncategorized-count: 2min cache (1.3s→42ms on repeat)
- Both endpoints document Actual Budget per-account API constraint
- Budget buildLookups: 2min cache (already in place)
- All inventory full scans already eliminated (prior commit)

services/inventory/server.js

@@ -190,10 +190,6 @@ app.get('/search-records', async (req, res) => {
 });
 
 // Test endpoint
-app.get('/test', (req, res) => {
-    res.json({ message: 'Server is working!', timestamp: new Date() });
-});
-
 // Get single item details
 app.get('/item-details/:id', async (req, res) => {
     try {