refactor: add services layer on the Gitea Go SDK (#1125)

- `internal/services`: typed Gitea workflows built on `gitea.dev/sdk`, independent of CLI flags and terminal I/O: issues, pull requests, reviews, comments, labels, milestones, releases and assets, repositories, branches, wiki, Actions (workflows, runs, jobs, logs, artifacts, secrets, variables), organizations, teams, webhooks, notifications, SSH keys, tracked time, admin users, search and status.
- SDK types are mapped to tea's own output types, so `--json` stays a stable contract. Requests the SDK cannot express yet (e.g. pull list filters, multi-status run lists, org label archiving) go through small raw helpers, each marked `TODO(sdk)` with the missing SDK piece.
- Targets Gitea 28 or newer: no version or API-schema probing. List helpers fill pages capped by `MAX_RESPONSE_ITEMS`.

Nothing imports this package yet.

Reviewed-on: https://gitea.com/gitea/tea/pulls/1125
Reviewed-by: TheFox0x7 <95654+thefox0x7@noreply.gitea.com>

internal/services/attachments.go

@@ -0,0 +1,83 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package services
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"io"
+	"mime/multipart"
+	"net/http"
+	"net/url"
+	"strings"
+
+	gitea "gitea.dev/sdk"
+	"gitea.dev/tea/internal/transport"
+)
+
+// ReleaseAsset is the public metadata of a release attachment.
+type ReleaseAsset struct {
+	ID            int64  `json:"id"`
+	Name          string `json:"name"`
+	Size          int64  `json:"size"`
+	URL           string `json:"url"`
+	CreatedAt     string `json:"created_at"`
+	DownloadCount int64  `json:"download_count"`
+}
+
+// IssueAttachment describes an attachment owned by an issue or pull request.
+type IssueAttachment ReleaseAsset
+
+func assetFrom(attachment *gitea.Attachment) ReleaseAsset {
+	return ReleaseAsset{
+		ID: attachment.ID, Name: attachment.Name, Size: attachment.Size, URL: attachment.DownloadURL,
+		CreatedAt: timestamp(attachment.Created), DownloadCount: attachment.DownloadCount,
+	}
+}
+
+// uploadAttachment streams a multipart upload to an attachment collection endpoint without
+// buffering the file in memory.
+// TODO(sdk): CreateReleaseAttachment and CreateIssueAttachment buffer the whole file.
+func uploadAttachment(ctx context.Context, client *transport.Client, endpoint, name string, input io.Reader) (ReleaseAsset, error) {
+	reader, writer := io.Pipe()
+	multipartWriter := multipart.NewWriter(writer)
+	defer reader.Close()
+	go func() {
+		part, err := multipartWriter.CreateFormFile("attachment", name)
+		if err == nil {
+			_, err = io.Copy(part, input)
+		}
+		if err == nil {
+			err = multipartWriter.Close()
+		}
+		_ = writer.CloseWithError(err)
+	}()
+	response, err := client.Do(ctx, http.MethodPost, endpoint, reader, http.Header{"Content-Type": {multipartWriter.FormDataContentType()}})
+	if err != nil {
+		return ReleaseAsset{}, err
+	}
+	defer response.Body.Close()
+	var attachment gitea.Attachment
+	if err := json.NewDecoder(response.Body).Decode(&attachment); err != nil {
+		if ctx.Err() != nil {
+			return ReleaseAsset{}, ctx.Err()
+		}
+		return ReleaseAsset{}, errInvalidJSON
+	}
+	return assetFrom(&attachment), nil
+}
+
+// downloadAttachment opens the content of an attachment read from its owning release or issue,
+// following one signed storage redirect without credentials.
+func downloadAttachment(ctx context.Context, client *transport.Client, attachment *gitea.Attachment) (io.ReadCloser, error) {
+	if attachment.UUID == "" || strings.ContainsAny(attachment.UUID, "/\\.") {
+		return nil, errors.New("invalid attachment identifier from Gitea")
+	}
+	response, err := client.DownloadSigned(ctx, strings.TrimRight(client.BaseURL, "/")+"/attachments/"+url.PathEscape(attachment.UUID))
+	if err != nil {
+		return nil, err
+	}
+	return response.Body, nil
+}