feat(p12a): services git distants (PAT/app_password) + clone HTTPS

Modèle de données :
- migration #11 git_credentials (secrets chiffrés SecretBox : secret_encrypted ; colonnes ssh/oauth posées pour P12b/P12c) ; #12 repos ALTER remote_url/git_service/credential_id (pas de FK)
- types partagés api.ts (GitCredentialSummary sans secret + hasSecret/secretLast4, CRUD, RemoteRepoSummary, Clone*) ; protocole additif : topic 'clones' + message clone_update (CloneOperation)

Backend :
- core/git-credentials.ts (GitCredentialsManager(db, box)) : CRUD chiffré, test() (GET /user), getSecret()/authContext() internes, NULLification de repos.credential_id à la suppression
- core/git-clients/ (github/gitlab/gitea) via fetch, sans dépendance : verify()+listRepos() paginés, erreurs typées AUTH_FAILED/RATE_LIMITED/UNREACHABLE, SSRF base_url http(s)
- core/git-auth.ts : withGitAuth (GIT_ASKPASS éphémère 0o700, secret par env, GIT_TERMINAL_PROMPT=0, jamais dans l'URL/.git/config, nettoyage finally)
- core/git.ts cloneRepo (spawn git clone --progress, parse progression, timeout)
- core/clone-manager.ts (EventEmitter) : clone async, dest confiné sous scanRoots + non existant, auto-enregistrement via addRepo + métadonnées de provenance, nettoyage du clone partiel, events topic 'clones'
- routes/git-connections.ts (CRUD + /test + /:id/repos + POST /repos/clone 202 + GET /repos/clone/:id) ; app.ts câble box→GitCredentialsManager + CloneManager→gateway ; gateway relaie 'clones'

Frontend :
- ws-client subscribeClones ; stores git-connections + clone (suivi WS)
- components/settings/GitConnectionsSection (liste + formulaire pat/app_password, secret jamais ré-affiché) inséré dans SettingsView ; CloneRepoModal (connexion → repos distants paginés → dest scanRoots[0] → barre de progression WS → redirection) ; bouton « Cloner » dans DashboardView ; i18n EN+FR

Tests : git-credentials (round-trip SecretBox, résumé sans secret, NULLification) ; acceptance-p12.mjs (clone bare local file:// → clone_update done + repo enregistré + secret ABSENT de l'API, de la DB et du .git/config)

Sous-phases restantes : P12b (SSH), P12c (OAuth device flow).

packages/server/src/app.ts

@@ -12,6 +12,9 @@ import { PtyManager } from './core/pty-manager.js';
 import { DiscoveryService } from './core/discovery-service.js';
 import { SessionArchiveService } from './core/session-archive.js';
 import { SettingsBus } from './core/settings-bus.js';
+import { GitCredentialsManager } from './core/git-credentials.js';
+import { CloneManager } from './core/clone-manager.js';
+import { registerGitConnectionRoutes } from './routes/git-connections.js';
 import { WorktreeManager } from './core/worktree-manager.js';
 import { RepoDiscoveryService } from './core/repo-discovery.js';
 import { GroupManager } from './core/group-manager.js';
@@ -82,6 +85,8 @@ export interface AppBundle {
   push: PushService;
   fsWatcher: FsWatcherService;
   settingsBus: SettingsBus;
+  gitCredentials: GitCredentialsManager;
+  clones: CloneManager;
 }
 
 export function buildApp(config: Config, db: Db, serverVersion: string): AppBundle {
@@ -109,6 +114,9 @@ export function buildApp(config: Config, db: Db, serverVersion: string): AppBund
   const groups = new GroupManager(db);
   // P11 — bus de diffusion des réglages : PATCH /settings émet, la gateway relaie au topic 'settings'.
   const settingsBus = new SettingsBus();
+  // P12 — services git distants : `box` (SecretBox) câblé ici pour chiffrer les secrets des credentials.
+  const gitCredentials = new GitCredentialsManager(db, box);
+  const clones = new CloneManager(db, worktrees, gitCredentials);
 
   // En-têtes de sécurité sur toute réponse + no-store sur les réponses sensibles (API/WS).
   // onSend DOIT retourner le payload (sinon Fastify vide la réponse).
@@ -194,13 +202,14 @@ export function buildApp(config: Config, db: Db, serverVersion: string): AppBund
   registerFileRoutes(app, worktrees, db);
   registerPushRoutes(app, push, db);
   registerSettingsRoutes(app, db, config, serverVersion, push, settingsBus);
+  registerGitConnectionRoutes(app, gitCredentials, clones, db);
   registerFsRoutes(app);
   registerAuditRoutes(app, db);
   registerDataRoutes(app, db, auth);
   // La route websocket doit être déclarée APRÈS le chargement du plugin (contexte
   // encapsulé) — sinon le handler reçoit la signature REST (request, reply).
   void app.register(async (scoped) => {
-    registerWsGateway(scoped, manager, discovery, sessionArchive, worktrees, groups, settingsBus, serverVersion);
+    registerWsGateway(scoped, manager, discovery, sessionArchive, worktrees, groups, settingsBus, clones, serverVersion);
   });
 
   // SPA buildée embarquée dans le paquet npm (public/) — absente en dev (vite dev sert le front)
@@ -215,5 +224,5 @@ export function buildApp(config: Config, db: Db, serverVersion: string): AppBund
     });
   }
 
-  return { app, auth, manager, discovery, sessionArchive, repoDiscovery, worktrees, groups, push, fsWatcher, settingsBus };
+  return { app, auth, manager, discovery, sessionArchive, repoDiscovery, worktrees, groups, push, fsWatcher, settingsBus, gitCredentials, clones };
 }