auth: defer credential helper until 401, match git's behaviour

git-sync used to call git credential fill proactively whenever an HTTP endpoint had no explicit auth. Two problems with that:

• On hosts the user had never authenticated against, git fell back to an interactive Username:/Password: prompt — turning git-sync into an interactive command and breaking non-interactive runs (issue #63).
• For hosts where the helper did have credentials, we'd send a token to public repos that didn't need one — leaking a credential to a request the server hadn't actually challenged.

This change makes git-sync follow git's own HTTP auth flow:

• auth.Resolve no longer consults the credential helper. Anonymous (or explicit token / Entire DB token) is what comes back.
• HTTPConn gains a CredentialHelper interface. On a 401 it calls Lookup, retries the request with the returned credentials, and stores the auth on the conn so follow-up PostRPC calls reuse it.
• auth.GitCredentialHelper shells out to git credential fill / approve / reject with GIT_TERMINAL_PROMPT=0, so a misconfigured helper fails fast rather than blocking on a tty prompt.
• On a successful retry we tell the helper approve; on 401 or 403 (Cloudflare-style "Invalid or expired token") we tell it reject so stale credentials self-heal across runs.

Tests cover the full lifecycle: anonymous success skips the helper, 401 triggers Lookup + retry + Approve, retry-still-401 and retry-403 both trigger Reject, helper-with-no-credentials surfaces the original 401 cleanly, and explicit auth disables the helper fallback entirely.

Closes #63.