feat(coderepo): Add Gitea support and enhance repository configuration

[therealbrad]

Description

Add support for connecting to self-hosted Git servers (Gitea, Forgejo, Gogs) as code repository providers for QuickScript code context. Also hardens SSRF protections across all existing providers by adding DNS resolution validation and redirect protection.

New provider:

• GITEA enum value added to CodeRepositoryProvider
• GiteaRepoAdapter implements the abstract GitRepoAdapter using the /api/v1/ REST API shared by Gitea, Forgejo, Gogs, and compatible servers
• UI fields: Server URL, Personal Access Token, Owner, Repository
• Help text and admin column labels included

Security hardening (all providers):

• assertSsrfSafeResolved() — resolves DNS before every fetch and verifies the IP is not private, closing the DNS rebinding attack vector where a public hostname resolves to an internal IP (e.g., evil.com → 169.254.169.254)
• redirect: "manual" on all fetch calls with single-hop redirect following that validates the Location URL through SSRF checks before proceeding
• IPv6 link-local (fe80::) added to blocked ranges
• HTTP plaintext warning shown in the UI when any provider URL field uses http:// instead of https://

Related Issue

Closes #157

Type of Change

• Bug fix (non-breaking change that fixes an issue)
• New feature (non-breaking change that adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)
• Documentation update
• Refactoring (no functional changes)
• Performance improvement

How Has This Been Tested?

Describe the tests you ran to verify your changes:

• Unit tests
• Integration tests
• E2E tests
• Manual testing

New and updated test files:

• GiteaRepoAdapter.test.ts — 15 tests covering constructor, getDefaultBranch, listAllFiles (pagination, truncation, SHA fallback, URL encoding), getFileContent, testConnection, auth headers
• ssrf.test.ts — 9 new tests (32 total) for assertSsrfSafeResolved (DNS rebinding with loopback/10.x/192.168.x/AWS metadata, safe resolution, raw IP skip, DNS failure) plus fe80:: link-local and Gitea URL allowlist
• GitRepoAdapter.test.ts — 4 new tests (11 total) for Gitea instantiation, redirect following with SSRF validation, missing Location header, redirect: "manual" enforcement

All 226 adapter tests and 58 SSRF/adapter-specific tests pass.

Test Configuration:

• OS: macOS Darwin 25.4.0 (ARM)
• Node version: v22.x

Checklist

• My code follows the project's style guidelines
• I have performed a self-review of my code
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• My changes generate no new warnings
• I have added tests that prove my fix is effective or that my feature works
• New and existing unit tests pass locally with my changes
• Any dependent changes have been merged and published
• I have signed the CLA

Screenshots (if applicable)

Additional Notes

• Database migration required: The GITEA enum value is added to CodeRepositoryProvider. Running pnpm generate updates the Prisma schema; prisma db push applies it.
• Forgejo/Gogs compatibility: All three platforms share the same /api/v1/ REST API, so a single adapter covers them. The help text and labels make this explicit. Other servers with a Gitea-compatible API will work on a best-effort basis.
• SSRF hardening is provider-agnostic: The DNS resolution check and redirect protection apply to all providers (GitHub, GitLab, Bitbucket, Azure DevOps, Gitea), not just the new one. This is a security improvement independent of the feature.
• No breaking changes: Existing provider configurations are unaffected. The new enum value is additive.

[therealbrad]

This was coded to the spec, but i haven't fully tested since I don't have Gitea set up. I'll get to that and test it soon unless someone else has it set up and wants to help test for me.

[therealbrad]

I was able to set up a local Gitea repo and connect/pull files to use as context for QuickScript.

[therealbrad]

🎉 This PR is included in version 0.19.0 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀