feat(submodules): support auth and checkout submodule revisions

Add credential-aware submodule operations and a command to checkout a specific
tag or commit in a submodule without staging the parent repository.

- Backend (src-tauri):
  - Export checkout_submodule_revision and implement checkout_revision which
    validates tag vs commit inputs, verifies refs locally, and checks out the
    submodule in detached mode without modifying the parent's index.
  - Add optional username/password parameters to add_submodule and submodule_action
    flows. Implement submodule_git to call run_git_authenticated when credentials
    are supplied and classify auth failures by prefixing errors with "AUTH_FAILED:".
  - Wire authenticated variants (operate_authenticated, add_authenticated) and
    update fetch/update actions to use credentials where needed.
  - Add unit tests covering authenticated submodule commands, auth failure
    classification, and checkout-by-tag/commit behavior.

- Frontend:
  - App.svelte: introduce credential prompt flow (withSubmoduleCredentials,
    submit/cancel handlers), surface credential dialog on auth failures, and
    wire credentialed calls for initialize/add/update/fetch operations. Hook up
    checkoutSubmoduleRevision and listTags to the submodule dialog.
  - SubmoduleDialog.svelte: add UI for selecting destination folder, loading
    tags and checking out revisions; expose fetch action.
  - CredentialDialog.svelte: include "submodule" action and adjust labels.

- Docs:
  - README: document "Change commit or tag" and "Fetch tags & commits" behaviors.

The commit focuses only on enabling credentialed submodule interactions and
safe local checkouts of tags/commits; no other git behavior changes are made.

README.md

@@ -39,6 +39,9 @@ shows each submodule's recorded commit (from its parent's index), checked-out
 commit, and local changes. You can add a submodule, initialize it, check out its
 recorded commit, stage a changed reference, synchronize its URL from `.gitmodules`,
 or open it as a repository tab. Nested submodules are included by default.
+Use **Change commit or tag** to select a local tag or enter a commit hash;
+**Fetch tags & commits** downloads remote revisions using the submodule login.
+Checking out a revision leaves the parent index unchanged until you stage its reference.
 
 Checking out a recorded commit is blocked when the submodule has local changes;
 commit or stash them in that repository first. Adding a submodule stages