refactor(credstore): embed credential store and drop sdk-go dependency

- Embed the minimal credstore subset used by tea (SecureStore,
  EncryptedFileStore, KeyringStore, FileStore) as modules/credstore so
  external SDK renames can no longer break the build
- Keep the on-disk format fully compatible: AES-256-GCM values with the
  v1: prefix, credentials.json / credentials.json.enc paths, and the
  Token JSON field names are unchanged, verified by a ciphertext fixture
  generated with sdk-go v1.1.0
- Store the keyring master key under a tea-owned account name
- Reuse the existing kernel-level filelock module instead of the
  upstream lockfile protocol, removing a stale-lock race
- Cover roundtrip, keyring-unavailable fallback, and fixture decryption
  with tests using a mocked keyring
- Remove github.com/go-signet/sdk-go and promote
  github.com/zalando/go-keyring to a direct dependency

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

modules/credstore/codec.go

@@ -0,0 +1,49 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package credstore
+
+import (
+	"encoding/json"
+	"fmt"
+)
+
+// Codec handles encoding/decoding values to/from strings for storage.
+type Codec[T any] interface {
+	Encode(v T) (string, error)
+	Decode(s string) (T, error)
+}
+
+// JSONCodec encodes T as JSON.
+type JSONCodec[T any] struct{}
+
+// Encode marshals v to a JSON string.
+func (JSONCodec[T]) Encode(v T) (string, error) {
+	data, err := json.Marshal(v)
+	if err != nil {
+		return "", fmt.Errorf("failed to marshal data: %w", err)
+	}
+	return string(data), nil
+}
+
+// Decode unmarshals a JSON string into T.
+func (JSONCodec[T]) Decode(s string) (T, error) {
+	var v T
+	if err := json.Unmarshal([]byte(s), &v); err != nil {
+		return v, fmt.Errorf("failed to unmarshal data: %w", err)
+	}
+	return v, nil
+}
+
+// StringCodec is the identity codec for plain strings.
+type StringCodec struct{}
+
+// Encode returns the string as-is.
+func (StringCodec) Encode(v string) (string, error) {
+	return v, nil
+}
+
+// Decode returns the string as-is.
+func (StringCodec) Decode(s string) (string, error) {
+	return s, nil
+}