File tree sidebar fails on instances with `REQUIRE_SIGNIN_VIEW = true` (browser session is refused by `/api/v1`)

[blacklizard]

Actual Behavior

On an instance with

[service] REQUIRE_SIGNIN_VIEW = true

every file page shows "Could not load the file tree. Reload to try again." in the source sidebar, for signed-in users too. Forgejo 16.0.5, theme 0.2.0 with theme-github-templates.tar.gz installed.

Expected Behavior

The source tree loads for any user who can view the repository, the same way the file picker on the same page does.

Steps to reproduce

1. Install 0.2.0 with the templates archive on Forgejo 16.
2. Set REQUIRE_SIGNIN_VIEW = true under [service], restart.
3. Sign in, open any file in a repository.
4. Sidebar shows the error; DevTools shows GET /api/v1/repos/<owner>/<repo>/git/trees/<sha>?recursive=true answering 403 {"message":"Only signed in user is allowed to call APIs."}.

Bug Description

templates/repo/source_tree.tmpl sets data-api-url to /api/v1/repos/{owner}/{repo}/git/trees/{sha}?recursive=true and public/assets/js/repo-source-browser.js fetches it with the browser session. Forgejo does not accept the web session on /api/v1, so once anonymous API access is off the call is refused; the same URL with a token answers 200. On a public instance the request succeeds anonymously, which hides the problem in a default setup.

The web route /{owner}/{repo}/tree-list/{ref} is session-authenticated, returns every path in one response, and is already what templates/repo/file_picker.tmpl uses. Pointing the source tree at it fixes the sidebar with no change for public instances. PR to follow, verified on a 3,108-file repository (branch and commit views, deep paths, current file highlighted).

Screenshot