feat: reach the rest of Gitea with kettle api, and drop tea

The plugin required `tea`, Gitea's own CLI, for everything that is not an
issue: releases, pull requests, milestones, branches, actions, webhooks. That
put a second binary, a second set of logins nothing here could see, and 400
lines documenting somebody else's flags outside anything this repository can
test. One command over the transport that already existed removes all three.

Transport: `post` — the hand-rolled request the SDK cannot express, written for
the dependency endpoint — is generalized to an exported `Do`, and `post` is
three lines on top of it. Same http.Client, so the same RoundTripper files the
body under .kettle/payload/, the same `token …` header authenticates it, and a
non-2xx is the same *APIError. It does not paginate, does not reformat the
answer, and names no domain concept, so the layering test is untouched.

The endpoint rule is `tea api`'s, so an endpoint table written for that tool
still works — with one restriction it did not have: a full URL must be on this
instance. Every request carries the project's token in a header, and a URL on
another host would hand the token to whatever was typed.

Command: `kettle api <endpoint>` in a new `api` group, so the generator writes
plugins/kettle/skills/api/SKILL.md — group, directory and /kettle:api are one
word. No --repo and no --login, for the reason no sync command has them: a
cross-repository address is an address, and another instance is KETTLE_URL.
`-X DELETE` needs `--yes`; a flag typed on purpose is an operator's decision.

Scopes: a token minted for issues carries write:issue and answers 403 on the
first request outside issues, naming no scope. Gitea cannot be asked what a
token may do — its own token listing needs a password — so `auth add --scopes`
records it, `auth list` and `config` show it, and a 403 says which category it
is likely to be. Documentation only; nothing is checked against it.

skills/use — the tea reference, 239 lines of it — becomes skills/api: what to
ask for, which endpoints paginate, and how to write a body. Every mention of
`tea` as a requirement is gone from the manifests, the READMEs, the runner and
the four other skills; what survives is the back-compat with the old plugin,
which is a decision and not a debt.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

cli/internal/cmd/auth.go

@@ -27,16 +27,27 @@ argument is in the shell history the moment it is typed:
     kettle auth add --name noodles --url https://git.example.com < token.txt
     pass show gitea/token | kettle auth add --name noodles --url https://git.example.com
 
-` + "`list`" + ` never prints a token. There is no flag to make it.`,
+` + "`list`" + ` never prints a token. There is no flag to make it.
+
+--scopes RECORDS WHAT THE TOKEN WAS MINTED WITH, and records is all it does:
+nothing is checked against it and nothing is refused because of it. It is worth
+writing down because the instance will not answer the question — Gitea's own
+token listing needs a password, not a token, so a token cannot be asked what it
+may do. Gitea spells them <read|write>:<category>; issues need ` + "`write:issue`" + `,
+and everything ` + "`kettle api`" + ` reaches outside issues — releases, pull requests,
+branches, tags, actions — is ` + "`repository`" + `. A token minted for issues alone
+answers 403 there, and the 403 names no scope.`,
 		Examples: []Example{
 			{"kettle auth list", "what this machine holds"},
 			{"pass show gitea | kettle auth add --name noodles --url https://git.example.com", "add one, token on stdin"},
+			{"kettle auth add --name noodles --url https://git.example.com --scopes write:issue,write:repository < t.txt", "and write down what it can do"},
 			{"kettle auth remove noodles", "forget it"},
 		},
 		Setup: func(fs *flag.FlagSet) func([]string) error {
 			name := fs.String("name", "", "login name (add)")
 			url := fs.String("url", "", "instance URL, e.g. https://git.example.com (add)")
 			user := fs.String("user", "", "account this token belongs to; documentation only (add)")
+			scopes := fs.String("scopes", "", "what the token was minted with, comma separated, e.g. write:issue,write:repository; documentation only (add)")
 			token := fs.String("token", "", "token, if you would rather not use stdin (add)")
 
 			return func(args []string) error {
@@ -61,7 +72,14 @@ argument is in the shell history the moment it is typed:
 						if who == "" {
 							who = "—"
 						}
-						fmt.Printf("  %-16s %-40s %s\n", l.Name, l.URL, who)
+						// Not recorded is not the same as none, and a listing
+						// that printed "—" for both would be the reason somebody
+						// re-mints a token that was fine.
+						scopes := "(not recorded)"
+						if len(l.Scopes) > 0 {
+							scopes = strings.Join(l.Scopes, ", ")
+						}
+						fmt.Printf("  %-16s %-40s %-16s %s\n", l.Name, l.URL, who, scopes)
 					}
 					return nil
 
@@ -79,10 +97,11 @@ argument is in the shell history the moment it is typed:
 						return Fail("no token — pipe one in, or pass --token")
 					}
 					entry := config.Login{
-						Name:  *name,
-						URL:   strings.TrimRight(*url, "/"),
-						User:  *user,
-						Token: secret,
+						Name:   *name,
+						URL:    strings.TrimRight(*url, "/"),
+						User:   *user,
+						Scopes: splitScopes(*scopes),
+						Token:  secret,
 					}
 					if existing := logins.Find(*name); existing != nil {
 						*existing = entry
@@ -125,6 +144,21 @@ argument is in the shell history the moment it is typed:
 	})
 }
 
+// splitScopes reads the comma-separated list --scopes takes.
+//
+// Nothing here validates a scope name against Gitea's set: the set is the
+// server's and it grows, and a spelling this binary has not heard of is more
+// likely a newer Gitea than a typo. The field is a note to a human either way.
+func splitScopes(v string) []string {
+	var out []string
+	for _, s := range strings.Split(v, ",") {
+		if s = strings.TrimSpace(s); s != "" {
+			out = append(out, s)
+		}
+	}
+	return out
+}
+
 // readToken takes the first non-empty line of r, trimmed.
 //
 // The first line, not the whole stream: a token piped from a password manager