feat!: rebuild tea on Cobra with explicit noun/verb commands (#1126)

- **switch tea to the Cobra command tree:** `internal/app` wires the packages from parts 1–4 into explicit noun/verb commands with `--repo`, `--json` / `--jq`, `--sudo` and `--debug`; `main.go` points at it. Build, release and docs tooling (`tools/cli-docs`, Makefile, goreleaser, snap, CI) and README / CONTRIBUTING are updated.
- **remove the urfave/cli command tree:** deletes `cmd/`, `modules/`, the old integration tests, contrib completion scripts and the generated `docs/CLI.md`, and drops their dependencies. This commit only deletes.

## Breaking changes

This is a breaking release. It requires Gitea 28 or newer; configuration moves to separate `config.yml` and `hosts.yml` files and requires fresh authentication, and command names, aliases, flags and output formats change. `docs/migration-1.0.md` maps every old command, flag and environment variable to its replacement.

## Issues

fixes #1118
fixes #1116
fixes #1115
fixes #1094
fixes #1091
fixes #1073
fixes #1052
fixes #1032
fixes #1023
fixes #966
fixes #908
fixes #833
fixes #831
fixes #817
fixes #804
fixes #779
fixes #770
fixes #737
fixes #697
fixes #726
fixes #677
fixes #672
fixes #633
fixes #632
fixes #560
fixes #556
fixes #523
fixes #516
fixes #510
fixes #504
fixes #500
fixes #482
fixes #406
fixes #403
fixes #373
fixes #351
fixes #344
fixes #326
fixes #325
fixes #323
fixes #246
fixes #240
fixes #232
fixes #197
fixes #172
fixes #141
fixes #69
fixes #1110
fixes #569
fixes #480
fixes #666
fixes #670
fixes #457
fixes #643
fixes #498
fixes #490
fixes #1069
fixes #834
fixes #602
fixes #328
fixes #417
fixes #571
fixes #1029
fixes #489
fixes #1050
fixes #162
fixes #430
fixes #1087
fixes #683

Reviewed-on: https://gitea.com/gitea/tea/pulls/1126
Reviewed-by: TheFox0x7 <95654+thefox0x7@noreply.gitea.com>

modules/auth/oauth_test.go

@@ -1,129 +0,0 @@
-// Copyright 2026 The Gitea Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package auth
-
-import (
-	"context"
-	"encoding/json"
-	"fmt"
-	"net/http"
-	"net/http/httptest"
-	"net/url"
-	"os"
-	"path/filepath"
-	"runtime"
-	"sync"
-	"testing"
-	"time"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-// Regression test for the redirect_uri propagation bug: with --redirect-url
-// omitted, the callback listener picks a free port and opts.RedirectURL is
-// rewritten in place. The OAuth2 config must see that rewritten URL so the
-// token exchange sends the same redirect_uri the authorize step advertised
-// (RFC 6749 §4.1.3).
-func TestPerformBrowserOAuthFlow_RedirectURIMatchesAcrossAuthorizeAndExchange(t *testing.T) {
-	var (
-		mu                   sync.Mutex
-		authorizeRedirectURI string
-		exchangeRedirectURI  string
-	)
-
-	idp := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		switch r.URL.Path {
-		case "/login/oauth/authorize":
-			mu.Lock()
-			authorizeRedirectURI = r.URL.Query().Get("redirect_uri")
-			mu.Unlock()
-			cb, err := url.Parse(r.URL.Query().Get("redirect_uri"))
-			require.NoError(t, err)
-			q := cb.Query()
-			q.Set("code", "test-code")
-			q.Set("state", r.URL.Query().Get("state"))
-			cb.RawQuery = q.Encode()
-			http.Redirect(w, r, cb.String(), http.StatusFound)
-
-		case "/login/oauth/access_token":
-			require.NoError(t, r.ParseForm())
-			mu.Lock()
-			exchangeRedirectURI = r.PostForm.Get("redirect_uri")
-			mu.Unlock()
-			w.Header().Set("Content-Type", "application/json")
-			_ = json.NewEncoder(w).Encode(map[string]any{
-				"access_token": "test-token",
-				"token_type":   "Bearer",
-				"expires_in":   3600,
-			})
-
-		default:
-			http.NotFound(w, r)
-		}
-	}))
-	t.Cleanup(idp.Close)
-
-	// Replace the real browser opener with a goroutine that fetches the
-	// authorize URL, just like a real browser would.
-	origOpenBrowser := openBrowser
-	t.Cleanup(func() { openBrowser = origOpenBrowser })
-	openBrowser = func(authURL string) error {
-		go func() {
-			resp, err := http.Get(authURL)
-			if err == nil {
-				resp.Body.Close()
-			}
-		}()
-		return nil
-	}
-
-	// Leave RedirectURL empty so tea picks a random port.
-	_, token, err := performBrowserOAuthFlow(context.Background(), OAuthOptions{
-		URL:      idp.URL,
-		ClientID: "test-client-id",
-	})
-	require.NoError(t, err)
-	require.Equal(t, "test-token", token.AccessToken)
-
-	mu.Lock()
-	defer mu.Unlock()
-	require.NotEmpty(t, authorizeRedirectURI)
-	require.NotEmpty(t, exchangeRedirectURI)
-	assert.Equal(t, authorizeRedirectURI, exchangeRedirectURI,
-		"redirect_uri must match between authorize and token exchange (RFC 6749 §4.1.3)")
-}
-
-// Regression test for the browser opener hang: xdg-open does not exit until
-// the browser it launched does, and the callback is only consumed after
-// openBrowser returns. Waiting on the opener hangs the CLI even though the
-// user authenticated successfully.
-func TestOpenBrowser_DoesNotWaitForOpener(t *testing.T) {
-	if runtime.GOOS == "windows" || runtime.GOOS == "darwin" {
-		t.Skip("xdg-open is not the opener on this platform")
-	}
-
-	const (
-		fakeOpenerSleepTime = 10 * time.Second
-		openBrowserTimeout  = 2 * time.Second
-	)
-
-	// A stand-in xdg-open that holds the foreground the way a browser it had
-	// to launch would.
-	dir := t.TempDir()
-	opener := filepath.Join(dir, "xdg-open")
-	script := fmt.Sprintf("#!/bin/sh\nexec sleep %d\n", int(fakeOpenerSleepTime.Seconds()))
-	require.NoError(t, os.WriteFile(opener, []byte(script), 0o755))
-	t.Setenv("PATH", dir+string(os.PathListSeparator)+os.Getenv("PATH"))
-
-	done := make(chan error, 1)
-	go func() { done <- openBrowser("http://127.0.0.1:1/") }()
-
-	select {
-	case err := <-done:
-		require.NoError(t, err)
-	case <-time.After(openBrowserTimeout):
-		t.Fatal("openBrowser blocked on the opener; the callback would never be consumed")
-	}
-}