refactor: add settings, transport and alias packages (#1122)

Part 1/5 of the tea 1.0 rewrite.

**Stack** (split from #1121; each PR targets `main` and builds, tests and lints on its own — the shipped CLI only changes in part 5):

1. #1122 Toolchain and foundation packages ← this PR
2. #1123 Credentials and Git
3. #1124 Terminal
4. #1125 Services
5. #1126 CLI wiring, docs, removal of the old tree

## Changes

- **build:** require Go 1.27; bump gofumpt and golangci-lint to releases that can read Go 1.27 export data (own commit).
- `internal/clierr`: typed errors and executable exit codes.
- `internal/version`: build version and tags.
- `internal/filelock`: moved unchanged from `modules/filelock`.
- `internal/aliases`: user-defined command aliases.
- `internal/transport`: the HTTP client the Gitea SDK runs on (part 4): token, Sudo and SSH-signature auth, retries for safe reads, connect/TLS/response-header timeouts, typed API errors that keep Gitea's message, and a redacted request log for `--debug`; plus raw requests for `tea api`, signed downloads that follow object-storage redirects, and log streaming.
- `internal/settings`: split `config.yml` / `hosts.yml` with locked transactions, plus remote URL parsing.

Nothing imports these packages yet.

Note: `flake.nix` now asks for `go_1_27`; the pinned nixpkgs in `flake.lock` predates Go 1.27 and still needs a `nix flake update nixpkgs`.
Reviewed-on: https://gitea.com/gitea/tea/pulls/1122
Reviewed-by: TheFox0x7 <95654+thefox0x7@noreply.gitea.com>

internal/transport/download.go

@@ -0,0 +1,83 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package transport
+
+import (
+	"context"
+	"errors"
+	"net/http"
+	"net/url"
+)
+
+// Download opens an instance-scoped file URL without following redirects.
+func (c *Client) Download(ctx context.Context, raw string) (*http.Response, error) {
+	_, target, err := c.downloadTarget(raw)
+	if err != nil {
+		return nil, err
+	}
+	return c.get(ctx, target, false)
+}
+
+// downloadTarget returns the parsed instance URL and raw, which must lie within its base path.
+func (c *Client) downloadTarget(raw string) (*url.URL, *url.URL, error) {
+	base, target, err := c.scoped(raw, "download URL")
+	if err != nil {
+		return nil, nil, err
+	}
+	if !within(base, target, "/") {
+		return nil, nil, errors.New("download URL must belong to the selected instance and base path")
+	}
+	return base, target, nil
+}
+
+func (c *Client) get(ctx context.Context, target *url.URL, allowRedirect bool) (*http.Response, error) {
+	ctx, failure := CaptureErrors(ctx)
+	request, err := http.NewRequestWithContext(ctx, http.MethodGet, target.String(), nil)
+	if err != nil {
+		return nil, errors.New("cannot construct download request")
+	}
+	response, err := c.API().Do(request)
+	if err != nil {
+		return nil, RequestError(ctx, "download failed", err)
+	}
+	if (allowRedirect && redirect(response.StatusCode)) || (response.StatusCode >= 200 && response.StatusCode < 300) {
+		return response, nil
+	}
+	_ = response.Body.Close()
+	return nil, failure()
+}
+
+func redirect(status int) bool {
+	switch status {
+	case http.StatusMovedPermanently, http.StatusFound, http.StatusSeeOther, http.StatusTemporaryRedirect, http.StatusPermanentRedirect:
+		return true
+	}
+	return false
+}
+
+// DownloadSigned opens an instance-scoped file URL and follows at most one redirect without
+// credentials, such as Gitea's redirect to signed object-storage URLs. The redirect target may be
+// another host, but must use HTTPS or the instance's scheme. Automatic redirects remain disabled,
+// including on an injected HTTP client.
+func (c *Client) DownloadSigned(ctx context.Context, raw string) (*http.Response, error) {
+	base, target, err := c.downloadTarget(raw)
+	if err != nil {
+		return nil, err
+	}
+	response, err := c.get(ctx, target, true)
+	if err != nil || !redirect(response.StatusCode) {
+		return response, err
+	}
+	_ = response.Body.Close()
+	location, err := response.Location()
+	if err != nil {
+		return nil, errors.New("download returned an invalid redirect")
+	}
+	if location.Scheme != "https" && location.Scheme != base.Scheme {
+		return nil, errors.New("download redirect must use HTTPS or the instance's scheme")
+	}
+	unsigned := *c
+	unsigned.Token, unsigned.Signer, unsigned.Sudo = "", nil, ""
+	return unsigned.get(ctx, location, false)
+}