refactor: add credential and Git packages (#1123)

- `internal/auth`: credentials in the OS keyring or a private file, OAuth login with token refresh, SSH HTTP-signature signers (key files with passphrase prompt, ssh-agent keys and certificates), and the Git credential helper protocol.
- `internal/git`: cancellable Git subprocesses, repository and remote discovery (tracked remote via `branch.<name>.remote`), PR checkout by full ref, AGit push, branch cleanup.

Nothing imports these packages yet.

Reviewed-on: https://gitea.com/gitea/tea/pulls/1123
Reviewed-by: TheFox0x7 <95654+thefox0x7@noreply.gitea.com>

internal/auth/httpsign_agent.go

@@ -0,0 +1,30 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+//go:build !windows
+
+package auth
+
+import (
+	"errors"
+	"net"
+	"os"
+
+	"golang.org/x/crypto/ssh/agent"
+)
+
+// getAgent connects to the ssh-agent at SSH_AUTH_SOCK; release closes the connection.
+func getAgent() (client agent.Agent, release func(), err error) {
+	socket := os.Getenv("SSH_AUTH_SOCK")
+	if socket == "" {
+		return nil, nil, errors.New("no ssh-agent available")
+	}
+	if _, err := os.Stat(socket); err != nil {
+		return nil, nil, errors.New("no ssh-agent available")
+	}
+	conn, err := net.Dial("unix", socket)
+	if err != nil {
+		return nil, nil, errors.New("cannot connect to ssh-agent")
+	}
+	return agent.NewClient(conn), func() { _ = conn.Close() }, nil
+}