feat(auth): add credential mode (credentials/token) support

Introduces a credential mode for stored credentials and wire it to
per-remote URL resolution and operation flows. The UI, storage, and
remote interactions now track and persist the mode, enabling token
based auth alongside username/password credentials.

- Remote URL resolution now considers direction (pull/push) and mode
- Credential dialog, saving, and keychain handling updated to pass and
  respect the mode
- Unique askpass scripts generated per invocation to avoid clashes

src/lib/git.ts

@@ -373,16 +373,16 @@ export function push(path: string, username?: string, password?: string, forceWi
   return invoke<GitStatus>("push", { path, username: username ?? null, password: password ?? null, forceWithLease, remote: remote || null });
 }
 
-export function getRemoteUrl(path: string): Promise<string | null> {
-  return invoke<string | null>("get_remote_url", { path });
+export function getRemoteUrl(path: string, remote?: string, push = false): Promise<string | null> {
+  return invoke<string | null>("get_remote_url", { path, remote: remote || null, push });
 }
 
 export function credLoad(key: string): Promise<StoredCredential | null> {
   return invoke<StoredCredential | null>("cred_load", { key });
 }
 
-export function credSave(key: string, username: string, password: string): Promise<void> {
-  return invoke<void>("cred_save", { key, username, password });
+export function credSave(key: string, username: string, password: string, mode: "credentials" | "token" = "credentials"): Promise<void> {
+  return invoke<void>("cred_save", { key, username, password, mode });
 }
 
 export function credDelete(key: string): Promise<void> {