feat: reach the rest of Gitea with kettle api, and drop tea

The plugin required `tea`, Gitea's own CLI, for everything that is not an
issue: releases, pull requests, milestones, branches, actions, webhooks. That
put a second binary, a second set of logins nothing here could see, and 400
lines documenting somebody else's flags outside anything this repository can
test. One command over the transport that already existed removes all three.

Transport: `post` — the hand-rolled request the SDK cannot express, written for
the dependency endpoint — is generalized to an exported `Do`, and `post` is
three lines on top of it. Same http.Client, so the same RoundTripper files the
body under .kettle/payload/, the same `token …` header authenticates it, and a
non-2xx is the same *APIError. It does not paginate, does not reformat the
answer, and names no domain concept, so the layering test is untouched.

The endpoint rule is `tea api`'s, so an endpoint table written for that tool
still works — with one restriction it did not have: a full URL must be on this
instance. Every request carries the project's token in a header, and a URL on
another host would hand the token to whatever was typed.

Command: `kettle api <endpoint>` in a new `api` group, so the generator writes
plugins/kettle/skills/api/SKILL.md — group, directory and /kettle:api are one
word. No --repo and no --login, for the reason no sync command has them: a
cross-repository address is an address, and another instance is KETTLE_URL.
`-X DELETE` needs `--yes`; a flag typed on purpose is an operator's decision.

Scopes: a token minted for issues carries write:issue and answers 403 on the
first request outside issues, naming no scope. Gitea cannot be asked what a
token may do — its own token listing needs a password — so `auth add --scopes`
records it, `auth list` and `config` show it, and a 403 says which category it
is likely to be. Documentation only; nothing is checked against it.

skills/use — the tea reference, 239 lines of it — becomes skills/api: what to
ask for, which endpoints paginate, and how to write a body. Every mention of
`tea` as a requirement is gone from the manifests, the READMEs, the runner and
the four other skills; what survives is the back-compat with the old plugin,
which is a decision and not a debt.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

cli/AGENTS.md

@@ -1,9 +1,23 @@
 # AGENTS.md — the kettle CLI
 
-`kettle` is a globally installed binary. It owns everything mechanical about
-issues: what an issue is, where the store lives, who this machine is, and how
-issues move to and from Gitea. It replaced a set of Python scripts that used to
-ship inside the plugin.
+`kettle` is a globally installed binary. **It owns this project's connection to
+its tracker** — the credentials, the transport, the payload scratchpad — and
+issues are its main subject but no longer its only one: what an issue is, where
+the store lives, who this machine is, how issues move to and from Gitea, and,
+through `kettle api`, every other Gitea entity that has no command of its own.
+It replaced a set of Python scripts that used to ship inside the plugin.
+
+That last clause is a deliberate widening and it is worth being straight about.
+"Issues and nothing else" was the line until two things crossed it: `cmd/release`,
+which publishes this repository's own releases, and `kettle api`, which exists
+because the alternative was requiring `tea` — a second CLI with a second set of
+logins that nothing here could see, documented in 400 lines of somebody else's
+flag reference that nothing here could check. One door for every request is worth
+more than a slogan: the token is held in one place, every body lands in one
+scratchpad, and no skill has to explain which tool is authenticated as whom.
+What has *not* widened is the domain — `internal/issue` still knows nothing about
+trackers, and `api` is transport plus a command, touching neither it nor
+`internal/mapping`.
 
 The plugin keeps what only a plugin can carry — the rules an operator states and
 a binary cannot enforce. Everything else is here.
@@ -154,7 +168,9 @@ would run under a login the model picked instead of the operator. That whole
 apparatus is gone. The binary holds its own credentials and reads the login out
 of the project's own configuration, so there is no argument to police and no way
 for the transport and the guard to disagree — the failure the hook existed to
-catch is not expressible any more.
+catch is not expressible any more. `kettle api` did not put it back: it takes an
+endpoint and a body, never a login, and a full URL on another host is refused
+rather than sent with this project's token attached.
 
 There is also no `--login` and no `--repo` on any sync command bar `labels`.
 A cross-repository address is still an address: `kettle pull owner/repo#42`
@@ -208,8 +224,8 @@ reason.
 
 Done and tested: every package in the table above, and the commands `init`, `auth`,
 `config`, `gen`, `version`, `new`, `check`, `ac`, `tree`, `index`, `evict`, `pull`,
-`push`, `remote`, `comment`, `close`, `labels`, `sync-evict` — plus `cmd/release`,
-against a fake Gitea.
+`push`, `remote`, `comment`, `close`, `labels`, `sync-evict`, `api` — plus
+`cmd/release`, against a fake Gitea.
 
 The plugin is rewired: it lives at `plugins/kettle`, ships no Python domain code
 and no guard hook, and its command reference is generated from this registry.