feat(auth): per-caller Gitea PAT pass-through (#59)

Replaces the shared GITEA_MCP_DEFAULT_TOKEN for all callers. When a
request's bearer validates directly against Gitea's own /api/v1/user,
that token is used for every upstream call this request makes instead
of the service PAT, and the caller identity comes from Gitea's own
login rather than the proxy header. Any other bearer (static token,
JWT, none) falls through unchanged to the existing chassis auth.

Prep: Authentik now SSOs into Gitea (infra a32801c), so each real user
can mint their own PAT from their own linked account.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

internal/gitea/client.go

@@ -3,6 +3,7 @@ package gitea
 import (
 	"bytes"
 	"context"
+	"encoding/json"
 	"fmt"
 	"io"
 	"net/http"
@@ -19,6 +20,21 @@ type Client struct {
 	branchCache *expirable.LRU[string, string]
 }
 
+type ctxTokenKey struct{}
+
+// WithToken overrides the token used for upstream Gitea calls made with the
+// returned context, taking precedence over the Client's configured default
+// token. Used for per-caller PAT pass-through (gitea-mcp#59).
+func WithToken(ctx context.Context, token string) context.Context {
+	return context.WithValue(ctx, ctxTokenKey{}, token)
+}
+
+// TokenFromContext returns the token set by WithToken, if any.
+func TokenFromContext(ctx context.Context) (string, bool) {
+	v, ok := ctx.Value(ctxTokenKey{}).(string)
+	return v, ok
+}
+
 func NewClient(baseURL, token string) *Client {
 	return &Client{
 		baseURL:     baseURL,
@@ -28,6 +44,23 @@ func NewClient(baseURL, token string) *Client {
 	}
 }
 
+// ValidateToken asks Gitea who a given token belongs to (GET /api/v1/user
+// using that token, not the client's configured default token) and returns
+// its login name. Used for per-caller PAT pass-through (gitea-mcp#59).
+func (c *Client) ValidateToken(ctx context.Context, token string) (string, bool) {
+	body, status, err := c.doOnce(WithToken(ctx, token), http.MethodGet, "/api/v1/user", nil)
+	if err != nil || status != http.StatusOK {
+		return "", false
+	}
+	var user struct {
+		Login string `json:"login"`
+	}
+	if err := json.Unmarshal(body, &user); err != nil || user.Login == "" {
+		return "", false
+	}
+	return user.Login, true
+}
+
 // DefaultBranch returns the default branch for a repo. Cached for 60s.
 func (c *Client) DefaultBranch(ctx context.Context, owner, name string) (string, error) {
 	key := owner + "/" + name
@@ -66,6 +99,9 @@ func (c *Client) doOnce(ctx context.Context, method, path string, body []byte) (
 		return nil, 0, err
 	}
 	token := c.token
+	if override, ok := TokenFromContext(ctx); ok {
+		token = override
+	}
 	if token != "" {
 		req.Header.Set("Authorization", "token "+token)
 	}
@@ -135,6 +171,9 @@ func (c *Client) doRaw(ctx context.Context, method, path string, body []byte) (*
 		return nil, err
 	}
 	token := c.token
+	if override, ok := TokenFromContext(ctx); ok {
+		token = override
+	}
 	if token != "" {
 		req.Header.Set("Authorization", "token "+token)
 	}