feat: auto-provision companion Dolt DBs from git.sr.ht pushes
Add a service-to-service path so pushing a git.sr.ht repo creates a matching
Dolt database at ~owner/name, ready before the user's first `dolt push`.
- web: POST /internal/repos, guarded by internal-IP + network-key `Internal`
auth (not the browser cookie/CSRF). Resolves/mirrors the owner via
auth.LookupUser, then CreateRepo + InitStore, rolling back the row if the
store init fails. Idempotent: an existing companion returns 200, a fresh one
201 — safe to call on every push.
- cmd/dolt-git-hook: the git.sr.ht post-update-script. Delegates every hook
stage to the stock /usr/bin/git.sr.ht-update-hook unchanged (argv[0], stdin,
env, exit code preserved; fail-closed if the delegate is missing), then on
post-update POSTs the companion create and prints a one-time clone notice.
Best-effort: never fails a push, degrades to a warning on any misconfig.
Tests cover the endpoint (provision/idempotent/rollback/bad-input) and the hook
(signed request round-trips through the guard's decryption, notice only on 201).
doltsrht: pass full os.Args to server.New so -b binds the web listener
getopt skips argv[0] as the program name, so os.Args[1:] made it swallow the
first real flag (-b) and silently fall back to defaultWebAddr (localhost),
leaving the web UI unreachable from Traefik. Match compare/upstream: pass os.Args.