feat(knowledge): support HTTPS + PAT auth for private git repos

[wbear1]

What

Adds HTTPS + Personal Access Token authentication for the knowledge base's
code-repo integration, so operators can clone/sync private Git repos over
HTTPS (e.g. a self-hosted GitLab) — alongside the existing SSH identity flow.

Why

Today the knowledge base can only authenticate to private repos via SSH keys.
Many environments hand out HTTPS PATs instead of deploy keys, so private
https://… repos can't be ingested. This closes that gap.

How

Backend

• New https_credentials table (GORM AutoMigrate) with CRUD across store / biz
  / server layers, mirroring the existing SSH identity design for consistency.
• Per-host credential matching — a repo URL selects its token by host (glob
  patterns supported in the hosts field).
• Token injected via a temporary GIT_ASKPASS script with
  GIT_TERMINAL_PROMPT=0; the askpass file is owner-only (0600) and removed
  after use. The token is never embedded in the URL.
• Tokens are write-only: stored server-side, never echoed back (DTO exposes
  has_token only).
• annotateGitError gains an HTTPS branch distinguishing "no credential for
  host" from "credential rejected", matching the existing SSH hints.

Frontend

• HTTPSCredentialsCard on the Code repos page: list / add / edit / delete,
  hosts matching, write-only token entry.
• Repo-creation error hint tells operators to add an HTTPS credential when a
  private HTTPS repo has none.

Testing

• go test ./internal/manager/biz/knowledge/... ./internal/manager/server/knowledge/... — pass
• npm run build in web/ — pass
• Unit tests cover buildHTTPSEnv askpass generation, buildGitAuthEnv
  routing, and per-host matching. An optional real-repo clone e2e smoke test
  skips when no test-repo env is provided.

One logical change; commit follows Conventional Commits.

Author confirmation

• I have read and agree to the project contribution guide in CONTRIBUTING.md.

[singchia]

Reviewed the scope again. This PR does include UI changes, mainly on the Code repos / Knowledge repos page:

• new Credentials · HTTPS card
• list / empty / loading / error states for HTTPS credentials
• Add HTTPS credential modal
• Edit HTTPS credential modal with write-only token behavior
• delete confirmation / post-delete state
• repo sync failure hint when a private HTTPS repo has no matching credential

Before merge, please add screenshots for the affected interactions, not just backend test results. At minimum:

1. Code repos page with the HTTPS credentials card collapsed and expanded
2. Empty HTTPS credentials state
3. Add credential modal
4. Edit credential modal showing token is not prefilled and blank means keep existing token
5. A configured credential row with hosts / username / has-token state
6. Private HTTPS repo sync error hint pointing the operator to add a matching HTTPS credential

Dark mode is enough if this page is dark-only in the current product path; include light mode too if the page supports it.

[wbear1]

@singchia Added the UI screenshots. This page supports both light and dark, so both themes are included. Screenshots are attached below:

Light

Dark