refactor: add credential and Git packages (#1123)

- `internal/auth`: credentials in the OS keyring or a private file, OAuth login with token refresh, SSH HTTP-signature signers (key files with passphrase prompt, ssh-agent keys and certificates), and the Git credential helper protocol.
- `internal/git`: cancellable Git subprocesses, repository and remote discovery (tracked remote via `branch.<name>.remote`), PR checkout by full ref, AGit push, branch cleanup.

Nothing imports these packages yet.

Reviewed-on: https://gitea.com/gitea/tea/pulls/1123
Reviewed-by: TheFox0x7 <95654+thefox0x7@noreply.gitea.com>

internal/git/agit_test.go

@@ -0,0 +1,66 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package git
+
+import (
+	"context"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestPushAgitPREncodesOptionsAndRefspec(t *testing.T) {
+	runner := &checkoutRunner{}
+	err := PushAgitPR(context.Background(), runner, AgitOptions{
+		Directory: "/work", Remote: "origin", Head: "feature", Base: "main", Topic: "feature",
+		Title: "Hello", Body: "line1\nline2", CredentialArgs: []string{"-c", "credential.helper=tea"},
+	})
+	require.NoError(t, err)
+	require.Equal(t, []string{
+		"rev-parse --is-inside-work-tree",
+		"-c credential.helper=tea push -o title=Hello -o description={base64}bGluZTEKbGluZTI= -- origin refs/heads/feature:refs/for/main/feature",
+	}, runner.calls)
+}
+
+func TestPushAgitPRRejectsSameBaseAndTopic(t *testing.T) {
+	runner := &checkoutRunner{}
+	err := PushAgitPR(context.Background(), runner, AgitOptions{Directory: "/work", Remote: "origin", Head: "main", Base: "main", Topic: "main"})
+	require.ErrorContains(t, err, "cannot create")
+	require.Empty(t, runner.calls)
+}
+
+func TestPushAgitPRWithOptionsToRealRemote(t *testing.T) {
+	if _, err := exec.LookPath("git"); err != nil {
+		t.Skip("Git is not installed")
+	}
+	root := t.TempDir()
+	env := append(os.Environ(), "GIT_CONFIG_GLOBAL="+filepath.Join(root, "gitconfig"), "GIT_CONFIG_NOSYSTEM=1",
+		"GIT_AUTHOR_NAME=tea", "GIT_AUTHOR_EMAIL=tea@example.invalid", "GIT_COMMITTER_NAME=tea", "GIT_COMMITTER_EMAIL=tea@example.invalid")
+	runner := System{Env: env}
+	remote, work := filepath.Join(root, "remote.git"), filepath.Join(root, "work")
+	for _, step := range []struct {
+		dir  string
+		args []string
+	}{
+		{root, []string{"init", "--bare", remote}},
+		{remote, []string{"config", "receive.advertisePushOptions", "true"}},
+		{root, []string{"init", "-b", "feature", work}},
+		{work, []string{"commit", "--allow-empty", "-m", "initial"}},
+		{work, []string{"remote", "add", "origin", remote}},
+	} {
+		_, err := runner.Output(context.Background(), step.dir, false, step.args...)
+		require.NoError(t, err, step.args)
+	}
+	require.NoError(t, PushAgitPR(context.Background(), runner, AgitOptions{
+		Directory: work, Remote: "origin", Head: "feature", Base: "main", Topic: "topic", Title: "Hello", Body: "line1\nline2",
+	}))
+	pushed, err := runner.Output(context.Background(), remote, false, "rev-parse", "refs/for/main/topic")
+	require.NoError(t, err)
+	local, err := runner.Output(context.Background(), work, false, "rev-parse", "HEAD")
+	require.NoError(t, err)
+	require.Equal(t, local, pushed)
+}