[fix]. Validate required startup secrets

src/gitea_codex_bot/main.py

@@ -35,6 +35,17 @@ logger = logging.getLogger(__name__)
 
 
 def _validate_required_env(settings: Settings) -> None:
+    webhook_secret = settings.gitea_webhook_secret.get_secret_value()
+    if not webhook_secret.strip():
+        raise RuntimeError("GITEA_WEBHOOK_SECRET is required")
+
+    gitea_token = settings.gitea_token.get_secret_value()
+    if not gitea_token.strip():
+        raise RuntimeError("GITEA_TOKEN is required")
+
+    if not settings.allowed_repos.strip():
+        raise RuntimeError("ALLOWED_REPOS is required")
+
     if settings.codex_auth_mode != "api_key":
         return
     api_key = settings.openai_api_key.get_secret_value() if settings.openai_api_key else ""