fix: allow vault info under path scope and clarify API errors

- Allow vault and vaults commands when a token has path restrictions

- Treat vault/vaults as pathless metadata commands in policy checks

- Add allowed commands, vaults and paths to 403 permission errors

- Surface real JWT failure reason in 401 instead of generic Unauthorized

- Report missing, malformed and empty Bearer tokens distinctly

- Catch httpRequest failures in the n8n node to avoid circular JSON

- Map API errors to clean NodeApiError with status code and detail

- Support continueOnFail with per-item error output in the n8n node

- Push a versioned image tag from pyproject in the CI workflow

- Bump server to 1.0.2 and n8n node package to 0.2.1

- Add tests for vault info access and richer auth error messages

.gitea/workflows/prod-docker-images.yml

@@ -27,6 +27,12 @@ jobs:
           token: "${{ secrets.ACTION_ACCESS_TOKEN }}"
           submodules: recursive
 
+      - name: Read app version
+        id: version
+        run: |
+          VERSION=$(grep -m1 '^version' pyproject.toml | sed -E 's/.*"(.*)".*/\1/')
+          echo "version=${VERSION}" >> "$GITHUB_OUTPUT"
+
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v4
 
@@ -48,3 +54,4 @@ jobs:
             OBSIDIAN_VERSION=${{ env.OBSIDIAN_VERSION }}
           tags: |
             ${{ vars.DOCKER_REGISTRY_URL }}/docker/${{ env.IMAGE_NAME }}:latest
+            ${{ vars.DOCKER_REGISTRY_URL }}/docker/${{ env.IMAGE_NAME }}:${{ steps.version.outputs.version }}