fix(gitea): WriteFile creates via POST, updates via PUT (real contents API)

A live token-scope probe against mathias/ai-sessions revealed gitea's
contents API uses POST to create and PUT (sha required) to update — the
first impl always PUT'd, so creating a new summary 422'd "[SHA]: Required".
The httptest mock had the same wrong assumption. Pick the method by
whether the file exists (GET sha). Token confirmed contents:write
(push:true) by the probe.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

ingestion/internal/gitea/gitea_test.go

@@ -117,18 +117,20 @@ func TestErrorPathDoesNotLeakToken(t *testing.T) {
 }
 
 func TestWriteFileCreatesNewFile(t *testing.T) {
-	var getPath, putPath, putBody string
+	var getPath, postPath, postBody string
 	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		switch r.Method {
 		case http.MethodGet:
 			getPath = r.URL.Path
 			w.WriteHeader(http.StatusNotFound) // file does not exist yet
-		case http.MethodPut:
-			putPath = r.URL.Path
+		case http.MethodPost: // gitea contents API: POST = create
+			postPath = r.URL.Path
 			b, _ := io.ReadAll(r.Body)
-			putBody = string(b)
+			postBody = string(b)
 			w.WriteHeader(http.StatusCreated)
 			_ = json.NewEncoder(w).Encode(map[string]any{"content": map[string]any{"html_url": "https://git/x"}})
+		default:
+			t.Errorf("create must POST, got %s", r.Method)
 		}
 	}))
 	defer srv.Close()
@@ -137,10 +139,10 @@ func TestWriteFileCreatesNewFile(t *testing.T) {
 		"ai-sessions", "summaries/claude-code/2026-06/2026-06-23-x-abcd1234.md", "# Summary\n\nbody\n")
 	require.NoError(t, err)
 	assert.Equal(t, "/api/v1/repos/mathias/ai-sessions/contents/summaries/claude-code/2026-06/2026-06-23-x-abcd1234.md", getPath)
-	assert.Equal(t, getPath, putPath)
+	assert.Equal(t, getPath, postPath)
 	// base64 of the content, no sha on create.
-	assert.Contains(t, putBody, "IyBTdW1tYXJ5") // base64("# Summary")
-	assert.NotContains(t, putBody, `"sha"`)
+	assert.Contains(t, postBody, "IyBTdW1tYXJ5") // base64("# Summary")
+	assert.NotContains(t, postBody, `"sha"`)
 }
 
 func TestWriteFileUpdatesExisting(t *testing.T) {