Repo clone: per-host PAT scoping for multi-repo sessions

[gatof81]

Follow-up to #188.

Blocked by

• Repo clone: multi-repo support #197 (multi-repo support) — this issue is structurally a no-op until a session can declare 2+ repos. Implementing the per-host PAT list before Repo clone: multi-repo support #197 means designing against a schema (repos: [{ … }]) that doesn't exist yet. Pick this up in the same wave as Repo clone: multi-repo support #197, or strictly after.

Problem

#188 ships a single per-session PAT routed through a git credential helper that answers any host. If a session clones two private repos on different hosts (e.g. one on github.com and one on a self-hosted GitLab), the user can only supply one token; the second clone gets the wrong creds.

Proposal

Replace the single-PAT shape with a list of per-host PATs:

auth: {
  pats: [
    { host: "github.com",       ciphertext, iv, tag },
    { host: "gitlab.internal",  ciphertext, iv, tag }
  ]
}

• Credential helper inspects the requested URL's host and returns the matching token (or no creds if no match).
• Form: change the single PAT input into a list of host | token rows.
• Migration from Repo clone: PAT + SSH auth, replace-workspace, uploads relocation #188's single-PAT shape: collapse it into a one-entry list with host: "*" to preserve behaviour, then deprecate * as a wildcard once all sessions migrate.
• Reuse Env vars & secrets: typed entries, AES-GCM-encrypted secrets, .env paste #186's AES-GCM crypto for each entry.

Out of scope

• SSH multi-key (one SSH key per session is fine for v1; revisit if needed).
• OAuth / GitHub App.

Acceptance

• A session with two private repos on different hosts clones both with the right token.
• No token leakage in argv or WS-streamed clone output (same regex assertion as Repo clone: PAT + SSH auth, replace-workspace, uploads relocation #188).
• Migration of existing single-PAT configs is automatic and transparent.