gitea-github-sync: show the actual HTTP response on a failed user check

"Failed to reach GitHub API. Check GITHUB_TOKEN." (and the equivalent
Gitea message) pointed at the token every time, even when the real cause
was something else entirely — confirmed live twice in one debugging
session: once a GitHub-side 503 outage, once a Gitea account locked
behind a must-change-password 403. Both times the fix was to run the
same curl by hand to see the actual status/response.

Fold that same probe into the script itself: on failure, re-request with
-i and print the HTTP status and response body directly, so the failure
mode (bad token vs. remote outage vs. account lock vs. network/DNS) is
visible immediately instead of requiring a manual curl round-trip.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01YEQNc4NfBST1m9NtCZVYa8

vendor/ai-stack/gitea-github-sync.sh

@@ -87,6 +87,26 @@ _github_api() {
 
 _log() { echo "[$(date '+%Y-%m-%d %H:%M:%S')] $*" >> "$LOG_FILE"; }
 
+# On a failed API call, "check your token" is often wrong — it could just as
+# easily be the remote service down, an account locked behind a
+# must-change-password wall, or a network/DNS problem. Re-probe with -i so
+# the actual HTTP status and response body are visible, instead of leaving
+# the user to run curl by hand to find out which one it actually was.
+_probe_and_report() {
+    local _what="$1" _url="$2"; shift 2
+    local _tmp _code _body
+    _tmp="$(mktemp)"
+    _code="$(curl -sS -o "$_tmp" -w '%{http_code}' "$@" "$_url" 2>/dev/null)"
+    _body="$(cat "$_tmp" 2>/dev/null)"
+    rm -f "$_tmp"
+    if [[ -z "$_code" || "$_code" == "000" ]]; then
+        warn "  $_what: no HTTP response at all — network/DNS problem reaching $_url, not a credentials problem."
+    else
+        warn "  $_what responded: HTTP $_code"
+        [[ -n "$_body" ]] && warn "  ${_body:0:300}"
+    fi
+}
+
 # ── config management ──────────────────────────────────────────────────────
 load_config() {
     mkdir -p "$CONFIG_DIR" "$WORK_DIR"
@@ -155,12 +175,22 @@ do_init() {
     # Discover usernames
     info "Detecting GitHub user..."
     GITHUB_USER=$(_github_api GET /user | python3 -c "import sys,json; print(json.load(sys.stdin)['login'])" 2>/dev/null) \
-        || { err "Failed to reach GitHub API. Check GITHUB_TOKEN."; exit 1; }
+        || {
+            err "Failed to reach GitHub API. Check GITHUB_TOKEN."
+            _probe_and_report "GitHub" "https://api.github.com/user" \
+                -H "Authorization: Bearer $GITHUB_TOKEN" -H "Accept: application/vnd.github+json"
+            exit 1
+        }
     ok "GitHub user: $GITHUB_USER"
 
     info "Detecting Gitea user..."
     GITEA_USER=$(_gitea_api GET /user | python3 -c "import sys,json; print(json.load(sys.stdin)['login'])" 2>/dev/null) \
-        || { err "Failed to reach Gitea API. Check GITEA_TOKEN and GITEA_URL ($GITEA_URL)."; exit 1; }
+        || {
+            err "Failed to reach Gitea API. Check GITEA_TOKEN and GITEA_URL ($GITEA_URL)."
+            _probe_and_report "Gitea" "$GITEA_URL/api/v1/user" \
+                -H "Authorization: token $GITEA_TOKEN"
+            exit 1
+        }
     ok "Gitea user: $GITEA_USER"
 
     # Ask about sync scope