ci: authenticated checkout via injected token

Anonymous HTTPS clone fails while the repo is private; token works either
way, and the internal gitea:3000 host skips the reverse proxy.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

.gitea/workflows/ci.yml

@@ -11,7 +11,9 @@ jobs:
       - name: Checkout
         run: |
           apt-get update -qq && apt-get install -y -qq git >/dev/null
-          git init -q . && git fetch -q --depth 1 "https://git.rehbock.xyz/${{ github.repository }}.git" "${{ github.sha }}" && git checkout -q FETCH_HEAD
+          # Token-authenticated fetch so CI works on private repos too; internal
+          # gitea:3000 host avoids the proxy round-trip.
+          git init -q . && git fetch -q --depth 1 "http://x:${{ secrets.GITHUB_TOKEN }}@gitea:3000/${{ github.repository }}.git" "${{ github.sha }}" && git checkout -q FETCH_HEAD
       - run: bun install --frozen-lockfile
       - run: bun run typecheck
       - run: bun run build:web