Restructure tea skill into a plugin with a mandatory-login guard

Convert the standalone `tea` skill into a skills-dir plugin so commands are
namespaced and an enforcement hook can ship with it:

- /tea:login  — pin the project Gitea login into .claude/settings.local.json
- /tea:use    — tea CLI reference (was the old root SKILL.md), with the
                login rule slimmed since the hook now enforces it
- hooks/tea-guard.sh — PreToolUse(Bash) guard: blocks any `tea` command that
  touches Gitea unless it carries --login and $GITEA_LOGIN is set. Exempts
  `tea logins list` and `tea --version/--help` so /tea:login can bootstrap.

References moved under skills/use/references/. `claude plugin validate` passes;
guard unit-tested across allow/block cases.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

skills/use/references/tea/entities.md

@@ -0,0 +1,130 @@
+# tea CLI — ENTITIES
+
+See [`./index.md`](./index.md) for global options and common flags shared by all commands.
+
+## `tea issues` (aliases: `issue`, `i`)
+Without args lists issues; with `<index>` shows issue detail.
+
+Shared filters: `--state {all|open|closed}` (default: open), `--kind {issues|pulls|all}`, `--keyword/-k`, `--labels/-L`, `--milestones/-m`, `--author/-A`, `--assignee/-a`, `--mentions/-M`, `--owner/--org`, `--from/-F`, `--until/-u`, `--comments`. Available fields: `index,state,kind,author,author-id,url,title,body,created,updated,deadline,assignees,milestone,labels,comments,owner,repo`.
+
+Subcommands:
+- `list, ls` — list (same filters as above).
+- `create, c` — create an issue. Options: `--title/-t`, `--description/-d`, `--assignees/-a`, `--labels/-L`, `--milestone/-m`, `--deadline/-D`, `--referenced-version/-v` (commit hash or tag).
+- `edit, e <idx>...` — edit. `--title`, `--description`, `--add-assignees/-a`, `--add-labels/-L`, `--remove-labels`, `--milestone`, `--deadline`, `--referenced-version`. To unset a value pass an empty string (`--milestone ""`).
+- `reopen, open <idx>...`
+- `close <idx>...`
+
+## `tea pulls` (aliases: `pull`, `pr`)
+Without args lists PRs; with `<index>` shows PR detail. Fields: `index,state,author,author-id,url,title,body,mergeable,base,base-commit,head,diff,patch,created,updated,deadline,assignees,milestone,labels,comments,ci`.
+
+Subcommands:
+- `list, ls` (`--state`)
+- `checkout, co <idx>` — check out PR locally. `--branch/-b` creates a local branch if missing.
+- `clean <idx>` — delete local and remote feature branches for a closed PR. `--ignore-sha` matches branch by name instead of commit hash.
+- `create, c` — create a PR. `--head <user:branch>`, `--base/-b`, `--allow-maintainer-edits/--edits`, `--agit`, `--topic`, plus all issue-style fields (`--title`, `--description`, `--assignees`, `--labels`, `--milestone`, `--deadline`, `--referenced-version`).
+- `close <idx>...`, `reopen, open <idx>...`
+- `edit, e <idx>...` — like `issues edit` plus `--add-reviewers/-r`, `--remove-reviewers`.
+- `review <idx>` — interactive review.
+- `approve, lgtm, a <idx> [comment]`
+- `reject <idx> <reason>`
+- `merge, m <idx>` — `--style/-s {merge|rebase|squash|rebase-merge}` (default merge), `--title/-t`, `--message/-m`.
+- `review-comments, rc <idx>` — list review comments. Fields: `id,body,reviewer,path,line,resolver,created,updated,url`.
+- `resolve <comment-id>` / `unresolve <comment-id>`
+
+## `tea labels` (alias: `label`)
+- `list, ls` — `--save/-s` dumps labels to a file.
+- `create, c` — `--name`, `--color`, `--description`, `--file` (bulk import from file).
+- `update` — `--id`, `--name`, `--color`, `--description`.
+- `delete, rm` — `--id`.
+
+## `tea milestones` (aliases: `milestone`, `ms`)
+Fields: `title,state,items_open,items_closed,items,duedate,description,created,updated,closed,id`.
+
+- `list, ls` (`--state`)
+- `create, c` — `--title/-t`, `--description/-d`, `--deadline/--expires/-x`, `--state`.
+- `close <name>...` — `--force/-f` deletes instead of closing.
+- `reopen, open <name>...`
+- `delete, rm <name>`
+- `issues, i <name>` — manage milestone contents:
+  - `add, a <name> <issue-idx>`
+  - `remove, r <name> <issue-idx>`
+
+## `tea releases` (aliases: `release`, `r`)
+- `list, ls`
+- `create, c [<tag>]` — `--tag`, `--target` (branch/commit), `--title/-t`, `--note/-n`, `--note-file/-f`, `--draft/-d`, `--prerelease/-p`, `--asset/-a <path>` (repeatable).
+- `edit, e <tag>...` — `--tag`, `--target`, `--title/-t`, `--note/-n`, `--draft/-d <bool>`, `--prerelease/-p <bool>`.
+- `delete, rm <tag>...` — `--confirm/-y` required; `--delete-tag` also removes the git tag.
+- `assets, asset, a` — manage release attachments:
+  - `list, ls <tag>`
+  - `create, c <tag> <asset>...`
+  - `delete, rm <tag> <attachment-name>...` — `--confirm/-y`.
+
+## `tea times` (aliases: `time`, `t`)
+Time tracking on issues/PRs. Fields: `id,created,repo,issue,user,duration`. Command-level: `--from/-f`, `--until/-u`, `--total/-t`, `--mine/-m`.
+
+- `add, a <issue> <duration>` — e.g. `tea times add 1 1h25m`.
+- `delete, rm <issue> <time-id>`
+- `reset <issue>`
+- `list, ls [username | #issue]` — username filters by user on the repo; `#N` filters by issue; `--mine` aggregates across all repos.
+
+## `tea organizations` (aliases: `organization`, `org`)
+- `list, ls`
+- `create, c <name>` — `--full-name/-n`, `--description/-d`, `--website/-w`, `--location/-L`, `--visibility/-v`, `--repo-admins-can-change-team-access`.
+- `delete, rm <name>`
+
+## `tea repos` (alias: `repo`)
+Fields: `description,forks,id,name,owner,stars,ssh,updated,url,permission,type`.
+
+- `list, ls` — `--watched/-w`, `--starred/-s`, `--owner/-O`, `--type/-T {fork|mirror|source}`.
+- `search, s [term]` — `--topic/-t`, `--type/-T`, `--owner/-O`, `--private {true|false}`, `--archived {true|false}`.
+- `create, c` — `--name`, `--owner/-O`, `--private`, `--description/--desc`, `--init`, `--labels`, `--gitignores/--git`, `--license`, `--readme`, `--branch`, `--template`, `--trustmodel {committer|collaborator|collaborator+committer}`, `--object-format {sha1|sha256}`.
+- `create-from-template, ct` — `--template/-t`, `--name/-n`, `--owner/-O`, `--private`, `--description/--desc`, copy toggles: `--content`, `--githooks`, `--avatar`, `--labels`, `--topics`, `--webhooks`.
+- `fork, f` — `--owner/-O` (default: current user).
+- `migrate, m` — `--name`, `--owner`, `--clone-url`, `--service {git|gitea|gitlab|gogs}`, `--mirror`, `--mirror-interval`, `--private`, `--template`, copy toggles: `--wiki`, `--issues`, `--labels`, `--pull-requests`, `--releases`, `--milestones`, `--lfs`, `--lfs-endpoint`, auth: `--auth-user`, `--auth-password`, `--auth-token`.
+- `delete, rm` — `--name`, `--owner/-O`, `--force/-f`.
+- `edit, e` — `--name`, `--description/--desc`, `--website`, `--private <bool>`, `--template <bool>`, `--archived <bool>`, `--default-branch`.
+
+## `tea branches` (aliases: `branch`, `b`)
+Fields: `name,protected,user-can-merge,user-can-push,protection`.
+
+- `list, ls`
+- `protect, P <branch>` — enable branch protection.
+- `unprotect, U <branch>` — remove protection.
+- `rename, rn <old> <new>`
+
+## `tea actions` (alias: `action`)
+CI management: secrets, variables, workflow definitions, workflow runs.
+
+### `tea actions secrets` (alias: `secret`)
+- `list, ls`
+- `create, add, set <name> [value]` — `--file` or `--stdin` to read the value.
+- `delete, remove, rm <name>` — `--confirm/-y`.
+
+### `tea actions variables` (aliases: `variable`, `vars`, `var`)
+- `list, ls` — `--name` to fetch a single variable.
+- `set, create, update <name> [value]` — `--file`, `--stdin`.
+- `delete, remove, rm <name>` — `--confirm/-y`.
+
+### `tea actions runs` (alias: `run`)
+- `list, ls` — `--status {success|failure|pending|queued|in_progress|skipped|canceled}`, `--branch`, `--event`, `--actor`, `--since`, `--until`.
+- `view, show, get <run-id>` — `--jobs` prints the jobs table.
+- `delete, remove, rm, cancel <run-id>` — `--confirm/-y`.
+- `logs, log <run-id>` — `--job <id>`, `--follow/-f` (requires the job to be in progress).
+
+### `tea actions workflows` (alias: `workflow`)
+- `list, ls`
+- `view, show, get <workflow-id>`
+- `dispatch, trigger, run <workflow-id>` — `--ref/-r`, `--input/-i key=value` (repeatable), `--follow/-f`.
+- `enable <workflow-id>`
+- `disable <workflow-id>` — `--confirm/-y`.
+
+## `tea webhooks` (aliases: `webhook`, `hooks`, `hook`)
+Scope is selected by flag: `--repo`, `--org`, `--global`.
+
+- `list, ls`
+- `create, c <webhook-url>` — `--type {gitea|gogs|slack|discord|dingtalk|telegram|msteams|feishu|wechatwork|packagist}` (default: gitea), `--secret`, `--events` (default: push), `--active`, `--branch-filter`, `--authorization-header`.
+- `update, edit, u <id>` — `--url`, `--secret`, `--events`, `--active` / `--inactive`, `--branch-filter`, `--authorization-header`.
+- `delete, rm <id>` — `--confirm/-y`.
+
+## `tea comment, c <issue/pr index> [body]`
+Add a comment to an issue or PR. Body may be passed as an argument or supplied interactively.