web: Forgejo basic auth (token-scheme headers 401 on this instance)

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

web/backend/src/m2_market_web/ledger.py

@@ -35,12 +35,20 @@ def _registry_raw_url(path: str) -> str:
     return f"{forgejo}/{repo}/raw/branch/main/{path}"
 
 
+def _b64(raw: str) -> str:
+    import base64
+
+    return base64.b64encode(raw.encode()).decode()
+
+
 async def _latest_audit_date() -> str:
     today = date.today().isoformat()
     forgejo = os.environ["FORGEJO_URL"].rstrip("/")
     repo = os.environ["REGISTRY_REPO"].strip("/")
     token = os.environ.get("FORGEJO_TOKEN", "")
-    headers = {"Authorization": f"token {token}"} if token else {}
+    user = os.environ.get("FORGEJO_USER", "m2")
+    # this Forgejo instance rejects token-scheme headers; HTTP basic only (forgejo skill)
+    headers = {"Authorization": "Basic " + _b64(f"{user}:{token}")} if token else {}
     async with client(forgejo, headers) as http:
         response = await http.get(f"/api/v1/repos/{repo}/contents/audit", params={"ref": "main"})
         response.raise_for_status()

web/backend/src/m2_market_web/registry.py

@@ -21,8 +21,13 @@ def _repo() -> str:
 
 
 def _headers() -> dict[str, str]:
+    import base64
+
     token = os.environ["FORGEJO_TOKEN"]
-    return {"Authorization": f"token {token}"}
+    user = os.environ.get("FORGEJO_USER", "m2")
+    # this Forgejo instance rejects token-scheme headers; HTTP basic only (forgejo skill)
+    basic = base64.b64encode(f"{user}:{token}".encode()).decode()
+    return {"Authorization": f"Basic {basic}"}
 
 
 def _age_days(created_at: str | None) -> int: