docs(gitea): document client token handling; move the token out of remote URLs

New tools/gitea/client-access.md: the credential file (~/.config/secrets/gitea,
0600) behind a global 'store --file' helper, the git 2.56 credential-store trap
(the key=value block shape parses to an empty get; the file must be one
http://user:token@host:port URL per line), the GIT_TERMINAL_PROMPT=0
verification loop, the lfs.locksverify key that silences the URL echo, and the
rotation procedure. Cross-linked from the gitea index and management pages.

Both workstation remotes are now bare URLs; the token lives in one file.

omp-docs/tools/gitea/index.md

@@ -55,6 +55,7 @@ The quadlet files, Caddyfile, and `.env.example` are tracked in the `serverAppCo
 
 - [[architecture|architecture]] — network topology and ports
 - [[management|management]] — operations, upgrades, backups, incident log
+- [[client-access|client-access]] — client-side tokens, the credential store, and the git 2.56 store-format trap
 - [[data-persistence|data-persistence]] — volumes and backup strategy
 - [[containers|containers]] — quadlet reference
 
@@ -63,3 +64,5 @@ The quadlet files, Caddyfile, and `.env.example` are tracked in the `serverAppCo
   * [Gitea Data Persistence](data-persistence.md) — Gitea data persistence, volume mounts, ownership, and backup strategy on dankclaw.
 
   * [Gitea Management](management.md) — Gitea container management, boot persistence, troubleshooting, upgrades, and backup procedures on dankclaw.
+
+  * [Gitea Client Access](client-access.md) — Token-based HTTP access from client workstations, credential store layout, and verification.