feat!: rebuild tea on Cobra with explicit noun/verb commands (#1126)

- **switch tea to the Cobra command tree:** `internal/app` wires the packages from parts 1–4 into explicit noun/verb commands with `--repo`, `--json` / `--jq`, `--sudo` and `--debug`; `main.go` points at it. Build, release and docs tooling (`tools/cli-docs`, Makefile, goreleaser, snap, CI) and README / CONTRIBUTING are updated.
- **remove the urfave/cli command tree:** deletes `cmd/`, `modules/`, the old integration tests, contrib completion scripts and the generated `docs/CLI.md`, and drops their dependencies. This commit only deletes.

## Breaking changes

This is a breaking release. It requires Gitea 28 or newer; configuration moves to separate `config.yml` and `hosts.yml` files and requires fresh authentication, and command names, aliases, flags and output formats change. `docs/migration-1.0.md` maps every old command, flag and environment variable to its replacement.

## Issues

fixes #1118
fixes #1116
fixes #1115
fixes #1094
fixes #1091
fixes #1073
fixes #1052
fixes #1032
fixes #1023
fixes #966
fixes #908
fixes #833
fixes #831
fixes #817
fixes #804
fixes #779
fixes #770
fixes #737
fixes #697
fixes #726
fixes #677
fixes #672
fixes #633
fixes #632
fixes #560
fixes #556
fixes #523
fixes #516
fixes #510
fixes #504
fixes #500
fixes #482
fixes #406
fixes #403
fixes #373
fixes #351
fixes #344
fixes #326
fixes #325
fixes #323
fixes #246
fixes #240
fixes #232
fixes #197
fixes #172
fixes #141
fixes #69
fixes #1110
fixes #569
fixes #480
fixes #666
fixes #670
fixes #457
fixes #643
fixes #498
fixes #490
fixes #1069
fixes #834
fixes #602
fixes #328
fixes #417
fixes #571
fixes #1029
fixes #489
fixes #1050
fixes #162
fixes #430
fixes #1087
fixes #683

Reviewed-on: https://gitea.com/gitea/tea/pulls/1126
Reviewed-by: TheFox0x7 <95654+thefox0x7@noreply.gitea.com>

internal/app/git_credentials_test.go

@@ -0,0 +1,86 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package app
+
+import (
+	"context"
+	"net/http"
+	"os"
+	"strings"
+	"testing"
+
+	"gitea.dev/tea/internal/auth"
+	"gitea.dev/tea/internal/clierr"
+	"github.com/stretchr/testify/require"
+)
+
+func TestGitCredentialHelperSelectsAccountsAndDoesNotMutateFromGit(t *testing.T) {
+	deps, out, diagnostics := testDeps(t)
+	manager := testManager(t, deps)
+	instance := "https://example.test/gitea"
+	require.NoError(t, manager.Register(instance, "alice", "file", "token", auth.HostOptions{}, auth.Credential{AccessToken: "alice-token"}))
+	require.NoError(t, manager.Register(instance, "bob", "file", "token", auth.HostOptions{}, auth.Credential{AccessToken: "bob-token"}))
+	for _, tc := range []struct{ host, path, user, operation, want string }{
+		{"example.test", "gitea/owner/repo.git", "", "get", "username=bob\npassword=bob-token\n\n"},
+		{"example.test", "gitea/owner/repo.git", "alice", "get", "username=alice\npassword=alice-token\n\n"},
+		{"example.test", "gitea/owner/repo.git", "unknown", "get", ""},
+		{"other.test", "gitea/owner/repo.git", "alice", "get", ""},
+		{"example.test", "other/owner/repo.git", "alice", "get", ""},
+		{"example.test", "gitea/owner/repo.git", "alice", "store", ""},
+		{"example.test", "gitea/owner/repo.git", "alice", "erase", ""},
+	} {
+		out.Reset()
+		deps.Streams.In = strings.NewReader("protocol=https\nhost=" + tc.host + "\npath=" + tc.path + "\nusername=" + tc.user + "\npassword=replacement-token\n\n")
+		require.NoError(t, Execute(context.Background(), deps, []string{"auth", "git-credential", tc.operation, "--no-input"}))
+		require.Equal(t, tc.want, out.String())
+		require.Empty(t, diagnostics.String())
+	}
+	credential, err := deps.Credentials.Load(instance, "alice", "file")
+	require.NoError(t, err)
+	require.Equal(t, "alice-token", credential.AccessToken)
+	deps.Streams.In = strings.NewReader("protocol=https\nhost=example.test\npath=gitea/owner/repo.git\nusername=bob\n\n")
+	out.Reset()
+	require.NoError(t, Execute(context.Background(), deps, []string{"auth", "git-credential", "get", "--user", "alice"}))
+	require.Empty(t, out.String())
+	err = Execute(context.Background(), deps, []string{"auth", "git-credential", "get", "--json"})
+	require.Equal(t, clierr.Usage, clierr.ExitCode(err))
+	require.Empty(t, out.String())
+}
+
+func TestGitCredentialHelperNeverEmitsInvalidStoredProtocolValues(t *testing.T) {
+	deps, out, _ := testDeps(t)
+	instance := "https://example.test"
+	manager := testManager(t, deps)
+	require.NoError(t, manager.Register(instance, "alice", "file", "token", auth.HostOptions{}, auth.Credential{AccessToken: "invalid-secret\nusername=other"}))
+	deps.Streams.In = strings.NewReader("protocol=https\nhost=example.test\npath=owner/repo.git\n\n")
+	err := Execute(context.Background(), deps, []string{"auth", "git-credential", "get"})
+	require.Error(t, err)
+	require.Equal(t, clierr.Authentication, clierr.ExitCode(err))
+	require.NotContains(t, err.Error(), "invalid-secret")
+	require.Empty(t, out.String())
+}
+
+func TestGitCredentialEnvironmentTokenIsScopedAndNeverPersisted(t *testing.T) {
+	server := newAuthenticatedServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { t.Fatalf("unexpected request %s", r.URL.Path) }))
+	defer server.Close()
+	deps, out, _ := testDeps(t)
+	deps.Getenv = envFunc(map[string]string{"TEA_HOST": server.URL, "GITEA_TOKEN": "environment-token"})
+	host := strings.TrimPrefix(server.URL, "http://")
+	deps.Streams.In = strings.NewReader("protocol=http\nhost=" + host + "\npath=alice/project.git\n\n")
+	require.NoError(t, Execute(context.Background(), deps, []string{"auth", "git-credential", "get"}))
+	require.Equal(t, "username=alice\npassword=environment-token\n\n", out.String())
+	files, err := os.ReadDir(deps.Settings.Dir)
+	require.NoError(t, err)
+	require.Empty(t, files)
+	for _, requestHost := range []string{"unrelated.test", host} {
+		out.Reset()
+		username := ""
+		if requestHost == host {
+			username = "someone-else"
+		}
+		deps.Streams.In = strings.NewReader("protocol=http\nhost=" + requestHost + "\npath=alice/project.git\nusername=" + username + "\n\n")
+		require.NoError(t, Execute(context.Background(), deps, []string{"auth", "git-credential", "get"}))
+		require.Empty(t, out.String())
+	}
+}