refactor: add settings, transport and alias packages (#1122)

Part 1/5 of the tea 1.0 rewrite.

**Stack** (split from #1121; each PR targets `main` and builds, tests and lints on its own — the shipped CLI only changes in part 5):

1. #1122 Toolchain and foundation packages ← this PR
2. #1123 Credentials and Git
3. #1124 Terminal
4. #1125 Services
5. #1126 CLI wiring, docs, removal of the old tree

## Changes

- **build:** require Go 1.27; bump gofumpt and golangci-lint to releases that can read Go 1.27 export data (own commit).
- `internal/clierr`: typed errors and executable exit codes.
- `internal/version`: build version and tags.
- `internal/filelock`: moved unchanged from `modules/filelock`.
- `internal/aliases`: user-defined command aliases.
- `internal/transport`: the HTTP client the Gitea SDK runs on (part 4): token, Sudo and SSH-signature auth, retries for safe reads, connect/TLS/response-header timeouts, typed API errors that keep Gitea's message, and a redacted request log for `--debug`; plus raw requests for `tea api`, signed downloads that follow object-storage redirects, and log streaming.
- `internal/settings`: split `config.yml` / `hosts.yml` with locked transactions, plus remote URL parsing.

Nothing imports these packages yet.

Note: `flake.nix` now asks for `go_1_27`; the pinned nixpkgs in `flake.lock` predates Go 1.27 and still needs a `nix flake update nixpkgs`.
Reviewed-on: https://gitea.com/gitea/tea/pulls/1122
Reviewed-by: TheFox0x7 <95654+thefox0x7@noreply.gitea.com>

internal/clierr/errors.go

@@ -0,0 +1,53 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package clierr
+
+import (
+	"context"
+	"errors"
+)
+
+// Public exit codes for errors returned by commands.
+const (
+	Failure        = 1
+	Usage          = 2
+	Canceled       = 3
+	Authentication = 4
+	Interrupted    = 130
+)
+
+// Error associates an operation error with a public CLI exit code.
+type Error struct {
+	Code int
+	Err  error
+}
+
+func (e *Error) Error() string { return e.Err.Error() }
+func (e *Error) Unwrap() error { return e.Err }
+
+// Wrap preserves the underlying error while assigning an exit code.
+func Wrap(code int, err error) error {
+	if err == nil {
+		return nil
+	}
+	return &Error{Code: code, Err: err}
+}
+
+// ExitCode translates returned errors into the executable exit contract.
+func ExitCode(err error) int {
+	if err == nil {
+		return 0
+	}
+	typed, ok := errors.AsType[*Error](err)
+	if ok && typed.Code == Interrupted {
+		return Interrupted
+	}
+	if errors.Is(err, context.Canceled) || errors.Is(err, context.DeadlineExceeded) {
+		return Canceled
+	}
+	if ok {
+		return typed.Code
+	}
+	return Failure
+}

internal/clierr/errors_test.go

@@ -0,0 +1,33 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package clierr
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestExitCodeDistinguishesCancellationAndInterruption(t *testing.T) {
+	for _, test := range []struct {
+		err  error
+		code int
+	}{
+		{nil, 0},
+		{errors.New("operation failed"), Failure},
+		{Wrap(Usage, errors.New("missing input")), Usage},
+		{Wrap(Authentication, errors.New("login required")), Authentication},
+		{context.Canceled, Canceled},
+		{context.DeadlineExceeded, Canceled},
+		{Wrap(Authentication, context.Canceled), Canceled},
+		{fmt.Errorf("draft preserved: %w", context.DeadlineExceeded), Canceled},
+		{Wrap(Interrupted, context.Canceled), Interrupted},
+		{errors.Join(errors.New("partial failure"), context.Canceled), Canceled},
+	} {
+		assert.Equal(t, test.code, ExitCode(test.err), "%v", test.err)
+	}
+}