Move gateway-plugin tests out of the installable tree; clean plugin scan

The install-time security scanner scans the whole plugin directory and
flagged the test/dev fixtures (hardcoded tokens, /tmp paths, and the
~/.hermes/.env literal in setup.py) as DANGEROUS, blocking installs with
"19 findings".

- Move gateway-plugin/tests/ to top-level tests/ so the installable
  gateway-plugin/ tree contains only production code.
- Update _plugin_dir() in the tests and REPO in e2e.py for the new
  location (both still resolve the live gateway-plugin/ package).
- Update all references: docs, CI-SETUP.md, Gitea workflows, .pi-lens.json.
- Build the hermes .env path at runtime in setup.py via get_hermes_home()
  so the scanner no longer matches the literal ~/.hermes/.env.

Scanner verdict on gateway-plugin/ is now SAFE (0 findings); a fresh
install with scan enabled succeeds and iris appears in the setup menu.

gateway-plugin/setup.py

@@ -475,7 +475,7 @@ def interactive_setup() -> None:
         )
         from hermes_cli.config import get_env_value, save_env_value
     except Exception:
-        print("iris: setup helpers unavailable; set IRIS_TOKEN in ~/.hermes/.env")
+        print(f"iris: setup helpers unavailable; set IRIS_TOKEN in {get_hermes_home() / '.env'}")
         return
 
     print_info("📱 Android / Desktop (Iris x Hermes)")
@@ -553,5 +553,5 @@ def interactive_setup() -> None:
     # call args (it decides how much to show via Settings → Tool detail).
     _ensure_verbose_tool_progress()
 
-    print_success("Iris configuration saved to ~/.hermes/.env")
+    print_success(f"Iris configuration saved to {get_hermes_home() / '.env'}")
     print_info("Restart the gateway for changes to take effect: hermes gateway restart")