probe for auth before streaming pack pushes

The previous commit's io.Seeker gate didn't help the production push path. internal/gitproto/push.go builds the receive-pack body as io.MultiReader(header, packData), where packData is the live pipe from upload-pack. That body satisfies neither io.Seeker nor any other replayable contract, so PostRPCStreamBody's on-the-fly 401 retry was a no-op for real pushes.

Fix: add HTTPConn.EnsureAuthForService(ctx, service) and call it from sendReceivePack before the body is constructed. It issues an anonymous GET to /<service>; if the server 401s, the helper is consulted, retried with credentials, and (on a non-401/403 response) c.Auth is stored so the streaming POST that follows is pre-authenticated.

The probe handles 2xx, 404, 405 etc. all as "credentials accepted" — any non-401/403 means the server didn't reject the creds we sent. 405 is the typical response for GET /git-receive-pack on smart-HTTP servers, so this is the common shape.

Limitation made explicit in the doc comment: servers that allow GET anonymously but only 401 on POST will slip past this probe. For those, callers must pass explicit credentials (--target-token).