refactor: add settings, transport and alias packages (#1122)

Part 1/5 of the tea 1.0 rewrite.

**Stack** (split from #1121; each PR targets `main` and builds, tests and lints on its own — the shipped CLI only changes in part 5):

1. #1122 Toolchain and foundation packages ← this PR
2. #1123 Credentials and Git
3. #1124 Terminal
4. #1125 Services
5. #1126 CLI wiring, docs, removal of the old tree

## Changes

- **build:** require Go 1.27; bump gofumpt and golangci-lint to releases that can read Go 1.27 export data (own commit).
- `internal/clierr`: typed errors and executable exit codes.
- `internal/version`: build version and tags.
- `internal/filelock`: moved unchanged from `modules/filelock`.
- `internal/aliases`: user-defined command aliases.
- `internal/transport`: the HTTP client the Gitea SDK runs on (part 4): token, Sudo and SSH-signature auth, retries for safe reads, connect/TLS/response-header timeouts, typed API errors that keep Gitea's message, and a redacted request log for `--debug`; plus raw requests for `tea api`, signed downloads that follow object-storage redirects, and log streaming.
- `internal/settings`: split `config.yml` / `hosts.yml` with locked transactions, plus remote URL parsing.

Nothing imports these packages yet.

Note: `flake.nix` now asks for `go_1_27`; the pinned nixpkgs in `flake.lock` predates Go 1.27 and still needs a `nix flake update nixpkgs`.
Reviewed-on: https://gitea.com/gitea/tea/pulls/1122
Reviewed-by: TheFox0x7 <95654+thefox0x7@noreply.gitea.com>

internal/filelock/filelock_test.go

@@ -0,0 +1,119 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package filelock
+
+import (
+	"os"
+	"path/filepath"
+	"strings"
+	"sync"
+	"sync/atomic"
+	"testing"
+	"time"
+)
+
+func TestLocker_WithLock(t *testing.T) {
+	tmpDir := t.TempDir()
+	lockPath := filepath.Join(tmpDir, "test.lock")
+
+	locker := New(lockPath, DefaultTimeout)
+
+	counter := 0
+	err := locker.WithLock(func() error {
+		counter++
+		return nil
+	})
+	if err != nil {
+		t.Fatalf("WithLock failed: %v", err)
+	}
+	if counter != 1 {
+		t.Errorf("Expected counter to be 1, got %d", counter)
+	}
+
+	// Lock file should have been created
+	if _, err := os.Stat(lockPath); os.IsNotExist(err) {
+		t.Error("Lock file should have been created")
+	}
+}
+
+func TestLocker_Acquire(t *testing.T) {
+	tmpDir := t.TempDir()
+	lockPath := filepath.Join(tmpDir, "test.lock")
+
+	locker := New(lockPath, DefaultTimeout)
+
+	unlock, err := locker.Acquire()
+	if err != nil {
+		t.Fatalf("Acquire failed: %v", err)
+	}
+
+	// Lock should be held
+	if unlock == nil {
+		t.Fatal("unlock function should not be nil")
+	}
+
+	// Release the lock
+	if err := unlock(); err != nil {
+		t.Fatalf("unlock failed: %v", err)
+	}
+}
+
+func TestLocker_ConcurrentAccess(t *testing.T) {
+	tmpDir := t.TempDir()
+	lockPath := filepath.Join(tmpDir, "test.lock")
+
+	locker := New(lockPath, 5*time.Second)
+
+	var wg sync.WaitGroup
+	var counter, active atomic.Int32
+	start := make(chan struct{})
+	numGoroutines := 10
+
+	for range numGoroutines {
+		wg.Go(func() {
+			<-start
+			err := locker.WithLock(func() error {
+				// OS file locks are not synchronization events for the race detector.
+				if active.Add(1) != 1 {
+					t.Error("lock allowed overlapping critical sections")
+				}
+				time.Sleep(time.Millisecond)
+				counter.Add(1)
+				active.Add(-1)
+				return nil
+			})
+			if err != nil {
+				t.Errorf("WithLock failed: %v", err)
+			}
+		})
+	}
+
+	close(start)
+	wg.Wait()
+
+	if counter.Load() != int32(numGoroutines) {
+		t.Errorf("Expected counter to be %d, got %d", numGoroutines, counter.Load())
+	}
+}
+
+func TestLocker_Timeout(t *testing.T) {
+	lockPath := filepath.Join(t.TempDir(), "test.lock")
+	unlock, err := New(lockPath, DefaultTimeout).Acquire()
+	if err != nil {
+		t.Fatalf("Acquire failed: %v", err)
+	}
+	defer unlock()
+
+	start := time.Now()
+	err = New(lockPath, 100*time.Millisecond).WithLock(func() error {
+		t.Error("lock acquired while another locker held it")
+		return nil
+	})
+	if err == nil || !strings.Contains(err.Error(), "timeout waiting for file lock") {
+		t.Fatalf("expected a lock timeout, got %v", err)
+	}
+	if elapsed := time.Since(start); elapsed < 100*time.Millisecond || elapsed > 2*time.Second {
+		t.Errorf("timeout took %v", elapsed)
+	}
+}