feat: reach the rest of Gitea with kettle api, and drop tea

The plugin required `tea`, Gitea's own CLI, for everything that is not an
issue: releases, pull requests, milestones, branches, actions, webhooks. That
put a second binary, a second set of logins nothing here could see, and 400
lines documenting somebody else's flags outside anything this repository can
test. One command over the transport that already existed removes all three.

Transport: `post` — the hand-rolled request the SDK cannot express, written for
the dependency endpoint — is generalized to an exported `Do`, and `post` is
three lines on top of it. Same http.Client, so the same RoundTripper files the
body under .kettle/payload/, the same `token …` header authenticates it, and a
non-2xx is the same *APIError. It does not paginate, does not reformat the
answer, and names no domain concept, so the layering test is untouched.

The endpoint rule is `tea api`'s, so an endpoint table written for that tool
still works — with one restriction it did not have: a full URL must be on this
instance. Every request carries the project's token in a header, and a URL on
another host would hand the token to whatever was typed.

Command: `kettle api <endpoint>` in a new `api` group, so the generator writes
plugins/kettle/skills/api/SKILL.md — group, directory and /kettle:api are one
word. No --repo and no --login, for the reason no sync command has them: a
cross-repository address is an address, and another instance is KETTLE_URL.
`-X DELETE` needs `--yes`; a flag typed on purpose is an operator's decision.

Scopes: a token minted for issues carries write:issue and answers 403 on the
first request outside issues, naming no scope. Gitea cannot be asked what a
token may do — its own token listing needs a password — so `auth add --scopes`
records it, `auth list` and `config` show it, and a 403 says which category it
is likely to be. Documentation only; nothing is checked against it.

skills/use — the tea reference, 239 lines of it — becomes skills/api: what to
ask for, which endpoints paginate, and how to write a body. Every mention of
`tea` as a requirement is gone from the manifests, the READMEs, the runner and
the four other skills; what survives is the back-compat with the old plugin,
which is a decision and not a debt.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

plugins/kettle/skills/sync/SKILL.md

@@ -12,7 +12,7 @@ second-guesses it. Knowledge flows one way: delete the tracker from the world an
 the issue domain does not notice.
 
 **No `kettle` on PATH?** `command not found: kettle` is the whole story — the
-Python scripts this plugin used to ship are gone and raw `tea` is not a
+Python scripts this plugin used to ship are gone and no other CLI is a
 substitute. Stop and tell the operator to install it: `cd cli && go build -o
 ~/.local/bin/kettle ./cmd/kettle` in the marketplace repository (go.mod requires
 **go 1.26**), or `go install
@@ -38,11 +38,12 @@ No login, an unknown login name, a 401: report it and stop — `/kettle:auth`.
 
 ## Never read an issue through a raw API dump
 
-`tea issues 42 -o json` and `tea api …/issues/42` put the whole payload —
-avatars, nested user objects, every comment body — into your context whether you
-need it or not. `kettle pull` writes flat markdown and prints a compact line per
-issue; `kettle remote` lists the tracker without writing anything at all. Use
-those.
+`kettle api repos/{owner}/{repo}/issues/42` will answer, and answering is the
+problem: the whole payload — avatars, nested user objects, every comment body —
+lands in your context whether you need it or not. `kettle pull` writes flat
+markdown and prints a compact line per issue; `kettle remote` lists the tracker
+without writing anything at all. Use those. `/kettle:api` is for the entities
+that have no command, and it says the same thing from its side.
 
 ## The round trip is one rule
 
@@ -183,9 +184,9 @@ request bodies are debris of the transport, and a scratchpad inside a store make
 `ls .kettle/issues` lie about what exists. Nothing in it is anybody's only copy —
 deleting it costs nothing. A run that sends nothing leaves no directory behind.
 
-For Gitea entities `kettle` does not cover — releases, webhooks, actions, pull
-requests — the tool is `tea`, and it keeps its own configuration and its own
-logins. `/kettle:use`.
+For Gitea entities `kettle` has no command for — releases, webhooks, actions,
+pull requests — `kettle api` sends the request under this same login, into this
+same scratchpad. `/kettle:api`.
 
 The commands themselves follow. Their usage lines, flags, defaults and examples
 are generated from the binary's own command registry, so they cannot disagree