authz: unified-login identity and git.sr.ht GraphQL authorization
Add the authz package: cookie-derived identity and per-request repository
authorization delegated to git.sr.ht's internal GraphQL API, with no local
database.
- identity.go: UsernameFromRequest decrypts the sr.ht.unified-login.v1 Fernet
cookie to a bare username ("" for anonymous, never rejects); Middleware/
ForContext carry it in the request context.
- authz.go: Authorizer interface + GQLAuthorizer over core-go client.Do. Repo
strips a leading ~ from the owner, maps null user/repository to
core.ErrNotFound (never leaking existence) and transport/GraphQL failures to
a wrapped non-NotFound error. MyRepos paginates me{repositories} to a 500-repo
cap. A mutex-guarded TTL cache memoizes positive and not-found Repo results
(keyed viewer\0owner\0name) but never transport errors, with lazy expiry and
opportunistic sweeps.
- Tests: in-memory config (generated Fernet + ed25519 keys) + httptest server
asserting the Internal auth header decrypts to the expected viewer; covers
cookie round-trip, found/null/500 repo cases, per-viewer cache keying, TTL
expiry, transport-error non-caching, and MyRepos pagination.