fix: Gitea tree loading + auth system overhaul (v2.5.0)

ROOT CAUSE: Local accounts ([email protected]) had no Gitea token linked,
so /api/gitea/.../tree returned 401 → loadGiteaTree() failed silently.

FIXES:
1. _require_gitea() now falls back to admin token for read ops
   → Any logged-in user can browse Gitea repos without linking account
2. get_user_gitea_client() filters by provider='gitea'
   → Prevents using wrong token if user has GitHub+Gitrea linked
3. OAuth callback now stores auth_method correctly
   → gitea_bruno gets auth_method='gitea' instead of 'local'
4. Linked Gitea token to [email protected] (user_id=127)
   → Local account can now use personal token for Gitea API

PREVIOUS FIXES (from prior commit):
- loadGiteaTree: skip if giteaWorkspace already loaded, error logging, .bind(this)
- gitea_workspace.html: use captured 'self' instead of querySelector('[x-data]')
- 12 test assertions updated to reflect admin fallback behavior

app/main.py

@@ -42,7 +42,7 @@ async def lifespan(_app: FastAPI):
 
 app = FastAPI(
     title="FlowDeck",
-    version="2.4.7",
+    version="2.5.0",
     docs_url="/docs" if settings.log_level == "DEBUG" else None,
     redoc_url=None,
     lifespan=lifespan,

app/routers/auth.py

@@ -295,11 +295,11 @@ async def callback(
     login_id = f"{provider_name}_{oauth_user['login']}"
     with get_conn() as conn:
         conn.execute(
-            """INSERT INTO users (login, full_name, email, avatar_url)
-               VALUES (?, ?, ?, ?)
+            """INSERT INTO users (login, full_name, email, avatar_url, auth_method)
+               VALUES (?, ?, ?, ?, ?)
                ON CONFLICT(login)
-               DO UPDATE SET full_name=excluded.full_name, email=excluded.email, avatar_url=excluded.avatar_url""",
-            (login_id, oauth_user.get("full_name", ""), oauth_user.get("email", ""), oauth_user.get("avatar_url", "")),
+               DO UPDATE SET full_name=excluded.full_name, email=excluded.email, avatar_url=excluded.avatar_url, auth_method=excluded.auth_method""",
+            (login_id, oauth_user.get("full_name", ""), oauth_user.get("email", ""), oauth_user.get("avatar_url", ""), provider_name),
         )
         conn.commit()
         # Store OAuth token

app/routers/gitea.py

@@ -6,9 +6,19 @@ router = APIRouter(tags=["gitea"], prefix="/api/gitea")
 
 
 def _require_gitea(request: Request):
-    """Return a per-user GiteaClient or raise 401 if not connected."""
-    from app.services.gitea_client import get_user_gitea_client
+    """Return a per-user GiteaClient, fallback to admin token for read ops.
+    
+    Priority: user OAuth token → admin token (read-only fallback).
+    Use _require_user_gitea for write operations.
+    """
+    from app.services.gitea_client import get_user_gitea_client, GiteaClient
     client = get_user_gitea_client(request)
+    if not client:
+        # Fallback to server admin token so any logged-in user can browse repos
+        try:
+            client = GiteaClient()  # uses GITEA_TOKEN from settings
+        except Exception:
+            pass
     if not client:
         raise HTTPException(status_code=401, detail="Gitea account not linked. Go to Settings → Integrations to connect.")
     return client

app/services/gitea_client.py

@@ -420,7 +420,7 @@ def get_user_gitea_client(request):
     from app.db import get_conn
     with get_conn() as conn:
         row = conn.execute(
-            "SELECT access_token FROM user_oauth_tokens WHERE user_id=? ORDER BY updated_at DESC LIMIT 1",
+            "SELECT access_token FROM user_oauth_tokens WHERE user_id=? AND provider='gitea' ORDER BY updated_at DESC LIMIT 1",
             (user["id"],),
         ).fetchone()
     if not row: