feat: reach the rest of Gitea with kettle api, and drop tea

The plugin required `tea`, Gitea's own CLI, for everything that is not an
issue: releases, pull requests, milestones, branches, actions, webhooks. That
put a second binary, a second set of logins nothing here could see, and 400
lines documenting somebody else's flags outside anything this repository can
test. One command over the transport that already existed removes all three.

Transport: `post` — the hand-rolled request the SDK cannot express, written for
the dependency endpoint — is generalized to an exported `Do`, and `post` is
three lines on top of it. Same http.Client, so the same RoundTripper files the
body under .kettle/payload/, the same `token …` header authenticates it, and a
non-2xx is the same *APIError. It does not paginate, does not reformat the
answer, and names no domain concept, so the layering test is untouched.

The endpoint rule is `tea api`'s, so an endpoint table written for that tool
still works — with one restriction it did not have: a full URL must be on this
instance. Every request carries the project's token in a header, and a URL on
another host would hand the token to whatever was typed.

Command: `kettle api <endpoint>` in a new `api` group, so the generator writes
plugins/kettle/skills/api/SKILL.md — group, directory and /kettle:api are one
word. No --repo and no --login, for the reason no sync command has them: a
cross-repository address is an address, and another instance is KETTLE_URL.
`-X DELETE` needs `--yes`; a flag typed on purpose is an operator's decision.

Scopes: a token minted for issues carries write:issue and answers 403 on the
first request outside issues, naming no scope. Gitea cannot be asked what a
token may do — its own token listing needs a password — so `auth add --scopes`
records it, `auth list` and `config` show it, and a 403 says which category it
is likely to be. Documentation only; nothing is checked against it.

skills/use — the tea reference, 239 lines of it — becomes skills/api: what to
ask for, which endpoints paginate, and how to write a body. Every mention of
`tea` as a requirement is gone from the manifests, the READMEs, the runner and
the four other skills; what survives is the back-compat with the old plugin,
which is a decision and not a debt.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

plugins/kettle/README.md

@@ -19,7 +19,7 @@ the tool.
 | `/kettle:project` skill | Generated flag reference for `init`, `auth`, `config`, `gen` |
 | `/kettle:issue` skill | Issues as units of work — create, read, grep, validate, tick, evict, walk the dependency graph. Entirely offline |
 | `/kettle:sync` skill | Moves issues between the local store and Gitea — pull, push, comment, close, evict |
-| `/kettle:use` skill | `tea` CLI reference for the Gitea entities kettle does not cover: pulls, releases, milestones, webhooks, actions |
+| `/kettle:api` skill | Everything else Gitea has, through `kettle api` and the same login: pull requests, releases, tags, milestones, branches, actions, webhooks, notifications |
 | `kettle-runner` agent | Subagent on Haiku that runs batches of commands and reports back a receipt — the mechanical half, off your main context |
 
 ## Prerequisites
@@ -27,17 +27,18 @@ the tool.
 - **Claude Code** — CLI, desktop app, or IDE extension.
 - **The `kettle` binary, on your `PATH`.** It is not installed for you, and
   nothing here works without it — see below.
-- **Python 3** — the two `agents-*` hooks are Python scripts; `python3` must be on
-  `$PATH`. Nothing else here needs it.
-- **`tea`** (optional) — Gitea's own CLI, only for `/kettle:use`. `brew install
-  tea`, or from [gitea.com/gitea/tea/releases](https://gitea.com/gitea/tea/releases).
-  It keeps its own logins (`tea logins add`), separate from kettle's.
+- **Python 3** — the `agents-sync` hook is a Python script despite its `.sh`
+  name; `python3` must be on `$PATH`. Nothing else here needs it.
+
+There is **no second CLI to install** — `kettle api`
+reaches every Gitea entity this plugin has no command for, under the login the
+project already pins.
 
 ### Installing the binary
 
 Building it needs **Go 1.26** — `cli/go.mod` says so because the Gitea SDK
-requires it. There is no `vendor/` directory: the first build downloads eight
-modules, verified against `go.sum`.
+requires it. `vendor/` is committed, so a build compiles exactly what is in this
+repository's history.
 
 ```bash
 # from a clone of this repository
@@ -147,8 +148,10 @@ command yourself; the saving is in the loop, the retry, and reading somebody
 else's stderr.
 
 It cannot decide anything. No `Edit`, no `Write`, no `--force`, no widening the
-set it was handed, no raw `tea`. A missing type, a failed validation, an unpushed
-dependency come back as a question, not as a guess.
+set it was handed, no request it composed itself — `kettle api` goes out as the
+caller spelled it, and a deletion is never something it adds. A missing type, a
+failed validation, an unpushed dependency come back as a question, not as a
+guess.
 
 ## Project layout
 
@@ -169,8 +172,7 @@ skills/
   issue/                     /kettle:issue — the issue domain, offline
     references/format.md       canonical issue format (identity, types, templates)
   sync/                      /kettle:sync — the bridge to Gitea
-  use/                       /kettle:use — tea CLI reference
-    references/tea/            command docs
+  api/                       /kettle:api — every other Gitea entity, by endpoint
 ```
 
 `AGENTS.md` carries the same layout with the reasoning behind it, and the