feat(clone): support credentialed git clone with askpass

Cloning now accepts optional username/password and passes them to the
Rust git layer via GIT_ASKPASS, avoiding interactive prompts. The UI
detects authentication failures, opens the credential dialog for clone,
and auto-hides error messages to keep the flow smooth.

- Add username/password support to clone_repository and git.ts
- Detect auth failures and route users to the clone credential dialog
- Improve clone UX with a dedicated loading overlay and timed errors

src/lib/components/CredentialDialog.svelte

@@ -14,7 +14,7 @@
   } from "@lucide/svelte";
 
   interface Props {
-    action: "push" | "pull" | "fetch";
+    action: "push" | "pull" | "fetch" | "clone";
     error: string;
     isBusy: boolean;
     onSubmit: (username: string, password: string, save: boolean, expiresAt: string | null) => void;
@@ -43,13 +43,21 @@
     password.trim().length > 0 &&
     (mode === "token" || username.trim().length > 0),
   );
-  let actionLabel = $derived(action === "push" ? "Push" : action === "fetch" ? "Fetch" : "Pull");
+  let actionLabel = $derived(action === "push" ? "Push" : action === "fetch" ? "Fetch" : action === "clone" ? "Clone" : "Pull");
   let actionTitle = $derived(
-    action === "push" ? "Authenticate push" : action === "fetch" ? "Authenticate fetch" : "Authenticate pull",
+    action === "push"
+      ? "Authenticate push"
+      : action === "fetch"
+        ? "Authenticate fetch"
+        : action === "clone"
+          ? "Authenticate clone"
+          : "Authenticate pull",
   );
   let actionHint = $derived(action === "push"
     ? "The remote needs write access. Use a password or a token with the appropriate repository permissions."
-    : "The remote needs access to the repository. Use your Git credentials or a personal access token.");
+    : action === "clone"
+      ? "The repository needs access before it can be cloned. Use your Git credentials or a personal access token."
+      : "The remote needs access to the repository. Use your Git credentials or a personal access token.");
 
   function handleSubmit(e: SubmitEvent) {
     e.preventDefault();