feat(git): add authenticated fetch and dual sync badge

This updates the Windows taskbar overlay badge to show ahead and
behind separately with distinct colors, and clears it when both are
zero. It also adds a new authenticated fetch command wired through
the Tauri backend and UI, including a silent background fetch to keep
ahead/behind (and the badge) accurate without user interaction.

- Add Windows dual badge rendering for ahead/behind
- Implement Tauri fetch command with auth error handling
- Add UI fetch action plus periodic background fetch updates

src/lib/TitleBar.svelte

@@ -2,7 +2,7 @@
   import { onDestroy, onMount } from "svelte";
   import { getVersion } from "@tauri-apps/api/app";
   import { getCurrentWindow } from "@tauri-apps/api/window";
-  import { Download, FolderOpen, GitBranch, GitCompare, LoaderCircle, Minus, RefreshCw, Search, Upload, X } from "@lucide/svelte";
+  import { CloudDownload, Download, FolderOpen, GitBranch, GitCompare, LoaderCircle, Minus, RefreshCw, Search, Upload, X } from "@lucide/svelte";
 
   export let branch: string = "";
   export let ahead: number = 0;
@@ -13,6 +13,7 @@
   export let operation: string = "";
   export let autoRefreshEnabled: boolean = true;
   export let autoRefreshInFlight: boolean = false;
+  export let onFetch: () => void = () => {};
   export let onPull: () => void = () => {};
   export let onPush: () => void = () => {};
   export let onRefresh: () => void = () => {};
@@ -122,6 +123,21 @@
         <span class="tb-action-label">Compare</span>
       </button>
 
+      <button
+        class="tb-action"
+        onclick={onFetch}
+        disabled={!hasRepository || isBusy}
+        title="Fetch"
+        aria-label="Fetch"
+      >
+        {#if operation === "Fetching"}
+          <LoaderCircle class="spin" size={14} aria-hidden="true" />
+        {:else}
+          <CloudDownload size={14} aria-hidden="true" />
+        {/if}
+        <span class="tb-action-label">Fetch</span>
+      </button>
+
       <button
         class="tb-action"
         onclick={onPull}

src/lib/components/CredentialDialog.svelte

@@ -14,7 +14,7 @@
   } from "@lucide/svelte";
 
   interface Props {
-    action: "push" | "pull";
+    action: "push" | "pull" | "fetch";
     error: string;
     isBusy: boolean;
     onSubmit: (username: string, password: string, save: boolean, expiresAt: string | null) => void;
@@ -43,8 +43,10 @@
     password.trim().length > 0 &&
     (mode === "token" || username.trim().length > 0),
   );
-  let actionLabel = $derived(action === "push" ? "Push" : "Pull");
-  let actionTitle = $derived(action === "push" ? "Authenticate push" : "Authenticate pull");
+  let actionLabel = $derived(action === "push" ? "Push" : action === "fetch" ? "Fetch" : "Pull");
+  let actionTitle = $derived(
+    action === "push" ? "Authenticate push" : action === "fetch" ? "Authenticate fetch" : "Authenticate pull",
+  );
   let actionHint = $derived(action === "push"
     ? "The remote needs write access. Use a password or a token with the appropriate repository permissions."
     : "The remote needs access to the repository. Use your Git credentials or a personal access token.");

src/lib/git.ts

@@ -141,6 +141,10 @@ export function pull(path: string, username?: string, password?: string): Promis
   return invoke<GitStatus>("pull", { path, username: username ?? null, password: password ?? null });
 }
 
+export function fetchRemote(path: string, username?: string, password?: string): Promise<GitStatus> {
+  return invoke<GitStatus>("fetch", { path, username: username ?? null, password: password ?? null });
+}
+
 export function push(path: string, username?: string, password?: string): Promise<GitStatus> {
   return invoke<GitStatus>("push", { path, username: username ?? null, password: password ?? null });
 }