docs(gitea): document client token handling; move the token out of remote URLs

New tools/gitea/client-access.md: the credential file (~/.config/secrets/gitea,
0600) behind a global 'store --file' helper, the git 2.56 credential-store trap
(the key=value block shape parses to an empty get; the file must be one
http://user:token@host:port URL per line), the GIT_TERMINAL_PROMPT=0
verification loop, the lfs.locksverify key that silences the URL echo, and the
rotation procedure. Cross-linked from the gitea index and management pages.

Both workstation remotes are now bare URLs; the token lives in one file.

omp-docs/tools/gitea/management.md

@@ -101,6 +101,7 @@ Verify the fix on the next host reboot.
 ## See Also
 
 - ](index.md) — index
+- [[client-access|client-access]] — how client hosts authenticate (token + credential store)
 - [[architecture|architecture]] — network topology
 - [[data-persistence|data-persistence]] — backups
 - [[containers|containers]] — quadlet reference