feat(p12a): services git distants (PAT/app_password) + clone HTTPS

Modèle de données :
- migration #11 git_credentials (secrets chiffrés SecretBox : secret_encrypted ; colonnes ssh/oauth posées pour P12b/P12c) ; #12 repos ALTER remote_url/git_service/credential_id (pas de FK)
- types partagés api.ts (GitCredentialSummary sans secret + hasSecret/secretLast4, CRUD, RemoteRepoSummary, Clone*) ; protocole additif : topic 'clones' + message clone_update (CloneOperation)

Backend :
- core/git-credentials.ts (GitCredentialsManager(db, box)) : CRUD chiffré, test() (GET /user), getSecret()/authContext() internes, NULLification de repos.credential_id à la suppression
- core/git-clients/ (github/gitlab/gitea) via fetch, sans dépendance : verify()+listRepos() paginés, erreurs typées AUTH_FAILED/RATE_LIMITED/UNREACHABLE, SSRF base_url http(s)
- core/git-auth.ts : withGitAuth (GIT_ASKPASS éphémère 0o700, secret par env, GIT_TERMINAL_PROMPT=0, jamais dans l'URL/.git/config, nettoyage finally)
- core/git.ts cloneRepo (spawn git clone --progress, parse progression, timeout)
- core/clone-manager.ts (EventEmitter) : clone async, dest confiné sous scanRoots + non existant, auto-enregistrement via addRepo + métadonnées de provenance, nettoyage du clone partiel, events topic 'clones'
- routes/git-connections.ts (CRUD + /test + /:id/repos + POST /repos/clone 202 + GET /repos/clone/:id) ; app.ts câble box→GitCredentialsManager + CloneManager→gateway ; gateway relaie 'clones'

Frontend :
- ws-client subscribeClones ; stores git-connections + clone (suivi WS)
- components/settings/GitConnectionsSection (liste + formulaire pat/app_password, secret jamais ré-affiché) inséré dans SettingsView ; CloneRepoModal (connexion → repos distants paginés → dest scanRoots[0] → barre de progression WS → redirection) ; bouton « Cloner » dans DashboardView ; i18n EN+FR

Tests : git-credentials (round-trip SecretBox, résumé sans secret, NULLification) ; acceptance-p12.mjs (clone bare local file:// → clone_update done + repo enregistré + secret ABSENT de l'API, de la DB et du .git/config)

Sous-phases restantes : P12b (SSH), P12c (OAuth device flow).

packages/web/src/stores/clone.ts

@@ -0,0 +1,40 @@
+import { defineStore } from 'pinia';
+import { ref } from 'vue';
+import type { CloneOperation, CloneRequest, CloneStartResponse } from '@arboretum/shared';
+import { api } from '../lib/api';
+import { wsClient, type CloneEvent } from '../lib/ws-client';
+
+// Suivi des opérations de clone (P12). État en mémoire alimenté par le push WS (topic 'clones') ;
+// chaque opération survit au refresh côté serveur (GET /repos/clone/:id), non rechargé ici.
+export const useCloneStore = defineStore('clone', () => {
+  const operations = ref<CloneOperation[]>([]);
+  let unsubscribe: (() => void) | null = null;
+
+  function upsert(op: CloneOperation): void {
+    const i = operations.value.findIndex((o) => o.id === op.id);
+    if (i >= 0) operations.value.splice(i, 1, op);
+    else operations.value.push(op);
+  }
+
+  function get(id: string): CloneOperation | undefined {
+    return operations.value.find((o) => o.id === id);
+  }
+
+  function startRealtime(): void {
+    unsubscribe ??= wsClient.subscribeClones((e: CloneEvent) => upsert(e.operation));
+  }
+  function stopRealtime(): void {
+    unsubscribe?.();
+    unsubscribe = null;
+  }
+
+  // Lance un clone ; la progression arrive ensuite par WS. Retourne l'operationId à suivre.
+  async function clone(req: CloneRequest): Promise<string> {
+    startRealtime(); // s'abonner AVANT de lancer pour ne manquer aucun event
+    const res = await api.post<CloneStartResponse>('/api/v1/repos/clone', req);
+    upsert({ id: res.operationId, state: 'pending', progress: null, phase: null, error: null, repoId: null, dest: req.dest });
+    return res.operationId;
+  }
+
+  return { operations, get, clone, startRealtime, stopRealtime };
+});

packages/web/src/stores/git-connections.ts

@@ -0,0 +1,65 @@
+import { defineStore } from 'pinia';
+import { ref } from 'vue';
+import type {
+  CreateGitCredentialRequest,
+  GitCredentialResponse,
+  GitCredentialSummary,
+  GitCredentialsListResponse,
+  RemoteReposResponse,
+  TestCredentialResponse,
+  UpdateGitCredentialRequest,
+} from '@arboretum/shared';
+import { api } from '../lib/api';
+
+// Connexions aux services git distants (P12). Les secrets ne transitent jamais en lecture
+// (résumés hasSecret/secretLast4 seulement) ; la création/maj envoie le secret en écriture.
+export const useGitConnectionsStore = defineStore('gitConnections', () => {
+  const connections = ref<GitCredentialSummary[]>([]);
+  const loading = ref(false);
+
+  function upsert(c: GitCredentialSummary): void {
+    const i = connections.value.findIndex((x) => x.id === c.id);
+    if (i >= 0) connections.value.splice(i, 1, c);
+    else connections.value.push(c);
+  }
+
+  async function fetchAll(): Promise<void> {
+    loading.value = true;
+    try {
+      connections.value = (await api.get<GitCredentialsListResponse>('/api/v1/git-connections')).credentials;
+    } finally {
+      loading.value = false;
+    }
+  }
+
+  async function create(req: CreateGitCredentialRequest): Promise<GitCredentialSummary> {
+    const res = await api.post<GitCredentialResponse>('/api/v1/git-connections', req);
+    upsert(res.credential);
+    return res.credential;
+  }
+
+  async function update(id: string, patch: UpdateGitCredentialRequest): Promise<GitCredentialSummary> {
+    const res = await api.patch<GitCredentialResponse>(`/api/v1/git-connections/${id}`, patch);
+    upsert(res.credential);
+    return res.credential;
+  }
+
+  async function remove(id: string): Promise<void> {
+    await api.delete<{ ok: true }>(`/api/v1/git-connections/${id}`);
+    connections.value = connections.value.filter((c) => c.id !== id);
+  }
+
+  async function test(id: string): Promise<TestCredentialResponse> {
+    const res = await api.post<TestCredentialResponse>(`/api/v1/git-connections/${id}/test`);
+    await fetchAll(); // rafraîchit lastTestedAt/testResult
+    return res;
+  }
+
+  function listRemoteRepos(id: string, page = 1, search?: string): Promise<RemoteReposResponse> {
+    const qs = new URLSearchParams({ page: String(page) });
+    if (search) qs.set('search', search);
+    return api.get<RemoteReposResponse>(`/api/v1/git-connections/${id}/repos?${qs.toString()}`);
+  }
+
+  return { connections, loading, fetchAll, create, update, remove, test, listRemoteRepos };
+});