fix(tgit): authenticate git-over-HTTPS clone with a PAT (private: user)

[m0Nst3r873]

Problem

Follow-up to #210 (merged). With the REST-auth fix in place, the MR knowledge-extract pipeline still failed at teamai init:

ℹ Repo teamai/teamai-dev-repo does not exist   ← it DOES exist
- Creating repo teamai/teamai-dev-repo...
✖ Failed to create repo: 400 {"message":"...Path has already been taken"}

Root cause (verified live against git.woa.com): a git-over-HTTPS credential's username depends on token type:

git URL username	OAuth token	PAT (TGIT_TOKEN)
oauth2:<token>@	✅	❌ auth fails
private:<token>@	❌	✅

The CLI hardcoded oauth2:, and two-segment repos routed to gf repo clone, whose own API lookup can't authenticate with a PAT (prints 未在工蜂找到 → misread as "not found" → misfired create → 400).

Changes

• rest-auth.ts: tgitGitUser(scheme) (PAT→private, OAuth→oauth2) + tryGetTGitToken() (non-throwing resolver).
• gfRepoClone: when a token exists, clone every repo via git clone https://<user>:<token>@… with the scheme-derived username; fall back to gf repo clone only when no token (interactive path, unchanged). Sanitizer redacts both oauth2: and private:.
• clone.ts: scheme-based username instead of hardcoded oauth2:.
• init.ts: a "repo already exists" create error is no longer fatal — retries the clone.
• CI example: netrc login private, clone via private:${TGIT_TOKEN}@.
• Unit tests for tgitGitUser / tryGetTGitToken.

Test Plan

• npx tsc --noEmit clean · npm run build · npx vitest run → 1786 passed
• Real E2E with a CI PAT (TGIT_TOKEN): gfRepoClone('teamai/teamai-dev-repo') clones via private: path; teamai init reaches ✔ Team repo cloned (previously the 400).

gf's auth login / gf commands are unchanged — they remain the no-token interactive fallback.

🤖 Generated with Claude Code