fork: resolve Gitea branch refs via the branches endpoint

Gitea's /repos/{o}/{r}/commits/{ref} only resolves 40-hex SHAs —
a branch name like "main" returns 404 even when the branch exists.
GitHub's API is more lenient and resolves branch names server-side.
resolveGiteaPinnedRef was calling /commits/{ref} and 404ing on
branch refs, so the entire import path failed before it could
read the tree. updateStatus already used the branches endpoint
correctly; this aligns resolveGiteaPinnedRef with it.

resolveGiteaCommitSha is now a SHA-only helper that refuses to
make the API call for non-SHA refs (matches Gitea's contract).
Test mocks updated to return the branch response shape.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

server/src/services/gitea-skills.ts

@@ -162,6 +162,11 @@ export async function resolveGiteaCommitSha(
   ref: string,
   apiBase: string,
 ): Promise<string> {
+  if (!/^[0-9a-f]{40}$/i.test(ref.trim())) {
+    throw unprocessable(
+      `Gitea /commits endpoint only resolves SHAs; got "${ref}". Use fetchGiteaBranch for branch names.`,
+    );
+  }
   const response = await fetchGiteaJson<GiteaCommitResponse>(
     `${apiBase}/repos/${owner}/${repo}/commits/${encodeURIComponent(ref)}`,
   );
@@ -191,7 +196,13 @@ export async function resolveGiteaPinnedRef(parsed: GiteaSourceUrl): Promise<{
   const trackingRef = parsed.explicitRef
     ? parsed.ref
     : await resolveGiteaDefaultBranch(parsed.owner, parsed.repo, apiBase);
-  const pinnedRef = await resolveGiteaCommitSha(parsed.owner, parsed.repo, trackingRef, apiBase);
+  // Gitea's /repos/{o}/{r}/commits/{ref} endpoint only resolves SHAs — a branch
+  // name returns 404. The branches endpoint accepts both branch names and tags.
+  const branch = await fetchGiteaBranch(apiBase, parsed.owner, parsed.repo, trackingRef);
+  const pinnedRef = asString(branch.commit?.id);
+  if (!pinnedRef) {
+    throw unprocessable(`Failed to resolve Gitea ref ${trackingRef}`);
+  }
   return { pinnedRef, trackingRef };
 }