refactor: add settings, transport and alias packages (#1122)

Part 1/5 of the tea 1.0 rewrite.

**Stack** (split from #1121; each PR targets `main` and builds, tests and lints on its own — the shipped CLI only changes in part 5):

1. #1122 Toolchain and foundation packages ← this PR
2. #1123 Credentials and Git
3. #1124 Terminal
4. #1125 Services
5. #1126 CLI wiring, docs, removal of the old tree

## Changes

- **build:** require Go 1.27; bump gofumpt and golangci-lint to releases that can read Go 1.27 export data (own commit).
- `internal/clierr`: typed errors and executable exit codes.
- `internal/version`: build version and tags.
- `internal/filelock`: moved unchanged from `modules/filelock`.
- `internal/aliases`: user-defined command aliases.
- `internal/transport`: the HTTP client the Gitea SDK runs on (part 4): token, Sudo and SSH-signature auth, retries for safe reads, connect/TLS/response-header timeouts, typed API errors that keep Gitea's message, and a redacted request log for `--debug`; plus raw requests for `tea api`, signed downloads that follow object-storage redirects, and log streaming.
- `internal/settings`: split `config.yml` / `hosts.yml` with locked transactions, plus remote URL parsing.

Nothing imports these packages yet.

Note: `flake.nix` now asks for `go_1_27`; the pinned nixpkgs in `flake.lock` predates Go 1.27 and still needs a `nix flake update nixpkgs`.
Reviewed-on: https://gitea.com/gitea/tea/pulls/1122
Reviewed-by: TheFox0x7 <95654+thefox0x7@noreply.gitea.com>

internal/aliases/aliases_test.go

@@ -0,0 +1,65 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package aliases
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestExpand(t *testing.T) {
+	builtins := map[string]bool{"issue": true, "pr": true}
+	for _, tc := range []struct {
+		expansion  string
+		args, want []string
+	}{
+		{"issue list --label 'good first issue'", []string{"bugs", "--limit", "5"}, []string{"issue", "list", "--label", "good first issue", "--limit", "5"}},
+		{"issue view $2", []string{"bugs", "left", "123", "--json"}, []string{"issue", "view", "123", "left", "--json"}},
+		{"issue create --title $1", []string{"bugs", "$(never execute)"}, []string{"issue", "create", "--title", "$(never execute)"}},
+		{"issue list --search '!wip'", []string{"bugs"}, []string{"issue", "list", "--search", "!wip"}},
+		{"issue list", []string{}, []string{}},
+	} {
+		got, err := Expand(tc.args, map[string]string{"bugs": tc.expansion}, builtins)
+		require.NoError(t, err)
+		require.Equal(t, tc.want, got)
+	}
+	got, err := Expand([]string{"a", "42"}, map[string]string{"a": "b", "b": "pr view"}, builtins)
+	require.NoError(t, err)
+	require.Equal(t, []string{"pr", "view", "42"}, got)
+}
+
+func TestRejectInvalidAliases(t *testing.T) {
+	builtins := map[string]bool{"issue": true}
+	for _, aliases := range []map[string]string{{"bad": ""}, {"bad": "issue '"}, {"bad": "a", "a": "bad"}, {"bad": "issue list | cat"}, {"bad": "issue list >> out"}, {"bad": "!echo hi"}, {"bad": "unknown list"}, {"bad": "$1 list"}} {
+		require.Error(t, Check("bad", aliases, builtins))
+		_, err := Expand([]string{"bad"}, aliases, builtins)
+		require.Error(t, err)
+	}
+	require.Error(t, Check("issue", map[string]string{"issue": "issue list"}, builtins))
+	_, err := Expand([]string{"a"}, map[string]string{"a": "issue view $1"}, builtins)
+	require.Error(t, err)
+	// A broken or colliding entry only fails when invoked; built-ins always win.
+	broken := map[string]string{"issue": "pr list", "bad": "unknown", "ok": "issue list"}
+	got, err := Expand([]string{"ok"}, broken, builtins)
+	require.NoError(t, err)
+	require.Equal(t, []string{"issue", "list"}, got)
+	got, err = Expand([]string{"issue", "view"}, broken, builtins)
+	require.NoError(t, err)
+	require.Equal(t, []string{"issue", "view"}, got)
+}
+
+func TestCompletionPreservesCurrentWordAfterFixedFlags(t *testing.T) {
+	definitions := map[string]string{"inspect": "pr view $1 --json number", "nested": "inspect $1"}
+	builtins := map[string]bool{"pr": true}
+	expanded, err := ExpandCompletion([]string{"nested", "7"}, definitions, builtins)
+	require.NoError(t, err)
+	require.Equal(t, []string{"pr", "view", "--json", "number", "7"}, expanded)
+	expanded, err = ExpandCompletion([]string{"inspect"}, definitions, builtins)
+	require.NoError(t, err)
+	require.Equal(t, []string{"inspect"}, expanded)
+	expanded, err = ExpandCompletion([]string{"nested", "7", "--j"}, definitions, builtins)
+	require.NoError(t, err)
+	require.Equal(t, []string{"pr", "view", "7", "--json", "number", "--j"}, expanded)
+}