Slice 8: configure git credentials + identity in the container

On startup the app runs git config --global to set a commit identity (GIT_USER_NAME/GIT_USER_EMAIL), safe.directory=* for host-owned mounts, and http.<GITEA_URL>.extraheader with the Gitea token so push/fetch/pull authenticate over HTTPS without an SSH key. New git.CLI.SetGlobalConfig and config fields. Verified: fetch via the app works and the identity/header are set.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

cmd/server/main.go

@@ -6,6 +6,7 @@ package main
 import (
 	"context"
 	"encoding/json"
+	"log/slog"
 	"net/http"
 	"os"
 	"os/signal"
@@ -26,6 +27,30 @@ import (
 	"gitmanager/internal/service"
 )
 
+// configureGit prepares the container's git for operating on the mounted repos:
+// a commit identity (so commits don't fail with "empty ident"), permission to
+// work on host-owned mounts, and — when a Gitea token is set — an auth header so
+// pushes/fetches over HTTPS succeed. The token is written to the container's
+// gitconfig (ephemeral, localhost); see AGENT.md §11.
+func configureGit(ctx context.Context, g *git.CLI, cfg config.Config, log *slog.Logger) {
+	set := func(key, value string) {
+		if err := g.SetGlobalConfig(ctx, key, value); err != nil {
+			log.Warn("git config failed", "key", key, "err", err)
+		}
+	}
+	set("safe.directory", "*") // mounted repos are host-owned
+	if cfg.GitUserName != "" {
+		set("user.name", cfg.GitUserName)
+	}
+	if cfg.GitUserEmail != "" {
+		set("user.email", cfg.GitUserEmail)
+	}
+	if cfg.GiteaURL != "" && cfg.GiteaToken != "" {
+		set("http."+cfg.GiteaURL+".extraheader", "Authorization: token "+cfg.GiteaToken)
+		log.Info("git remote auth configured", "host", cfg.GiteaURL)
+	}
+}
+
 func main() {
 	cfg, err := config.Load()
 	if err != nil {
@@ -46,6 +71,7 @@ func main() {
 	} else {
 		log.Info("git detected", "version", v)
 	}
+	configureGit(context.Background(), g, cfg, log)
 
 	// Start the read-only scanner in the background.
 	scanner := repos.NewScanner(g, log, cfg.RepoRoots, cfg.ScanMaxDepth, cfg.ScanIgnore, cfg.ScanInterval, cfg.ScanFetchEnabled)