refactor: add settings, transport and alias packages (#1122)

Part 1/5 of the tea 1.0 rewrite.

**Stack** (split from #1121; each PR targets `main` and builds, tests and lints on its own — the shipped CLI only changes in part 5):

1. #1122 Toolchain and foundation packages ← this PR
2. #1123 Credentials and Git
3. #1124 Terminal
4. #1125 Services
5. #1126 CLI wiring, docs, removal of the old tree

## Changes

- **build:** require Go 1.27; bump gofumpt and golangci-lint to releases that can read Go 1.27 export data (own commit).
- `internal/clierr`: typed errors and executable exit codes.
- `internal/version`: build version and tags.
- `internal/filelock`: moved unchanged from `modules/filelock`.
- `internal/aliases`: user-defined command aliases.
- `internal/transport`: the HTTP client the Gitea SDK runs on (part 4): token, Sudo and SSH-signature auth, retries for safe reads, connect/TLS/response-header timeouts, typed API errors that keep Gitea's message, and a redacted request log for `--debug`; plus raw requests for `tea api`, signed downloads that follow object-storage redirects, and log streaming.
- `internal/settings`: split `config.yml` / `hosts.yml` with locked transactions, plus remote URL parsing.

Nothing imports these packages yet.

Note: `flake.nix` now asks for `go_1_27`; the pinned nixpkgs in `flake.lock` predates Go 1.27 and still needs a `nix flake update nixpkgs`.
Reviewed-on: https://gitea.com/gitea/tea/pulls/1122
Reviewed-by: TheFox0x7 <95654+thefox0x7@noreply.gitea.com>

internal/filelock/filelock.go

@@ -0,0 +1,70 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package filelock
+
+import (
+	"fmt"
+	"os"
+	"time"
+)
+
+const (
+	// DefaultTimeout is the default timeout for acquiring a file lock.
+	DefaultTimeout = 5 * time.Second
+
+	// FileLockPollInterval is how often to retry acquiring the file lock.
+	FileLockPollInterval = 50 * time.Millisecond
+)
+
+// Locker provides file-based locking with timeout.
+type Locker struct {
+	path    string
+	timeout time.Duration
+}
+
+// New creates a Locker for the given lock file path.
+func New(lockPath string, timeout time.Duration) *Locker {
+	return &Locker{
+		path:    lockPath,
+		timeout: timeout,
+	}
+}
+
+// WithLock executes fn while holding the lock.
+func (l *Locker) WithLock(fn func() error) (retErr error) {
+	unlock, err := l.Acquire()
+	if err != nil {
+		return err
+	}
+	defer func() {
+		if unlockErr := unlock(); unlockErr != nil && retErr == nil {
+			retErr = fmt.Errorf("failed to release file lock: %w", unlockErr)
+		}
+	}()
+
+	return fn()
+}
+
+// Acquire acquires the file lock and returns an unlock function.
+// The caller must call the unlock function to release the lock.
+func (l *Locker) Acquire() (unlock func() error, err error) {
+	file, err := os.OpenFile(l.path, os.O_CREATE|os.O_RDWR, 0o600)
+	if err != nil {
+		return nil, fmt.Errorf("failed to open lock file: %w", err)
+	}
+
+	if err := lockFile(file, l.timeout); err != nil {
+		file.Close()
+		return nil, fmt.Errorf("failed to acquire file lock: %w", err)
+	}
+
+	return func() error {
+		unlockErr := unlockFile(file)
+		closeErr := file.Close()
+		if unlockErr != nil {
+			return unlockErr
+		}
+		return closeErr
+	}, nil
+}