gitea-image-prune.sh: auto-discover credentials from git

When GITEA_TOKEN/--token-file aren't set and the script runs inside a
Gitea-host clone, reuse git's stored credential: the token embedded in
the remote URL, else a configured credential helper (git credential fill,
no prompting). Switch to HTTP Basic auth (user:token) when a username is
known so both API tokens and the embedded-URL/helper credential work;
keep the token header for a bare GITEA_TOKEN. Banner reports the source.
Live-verified: env token + git credential helper (as kisfenyo) both list
and resolve OCI sizes.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

CHANGELOG.md

@@ -2,6 +2,19 @@
 
 All notable changes to the operator helper scripts. Newest on top.
 
+## 2026-06-17 (later)
+
+### Changed — `gitea-image-prune.sh`
+- Credential auto-discovery: when `GITEA_TOKEN`/`--token-file` are not set and the
+  script runs inside a Gitea-host clone, it reuses git's stored credential — the
+  token embedded in the remote URL, else a configured credential helper
+  (`git credential fill`, never prompting). Lets you run it from a configured
+  clone with no token. Startup banner reports the credential source + user.
+- Auth now uses HTTP Basic (`user:token`) when a username is known (so both API
+  tokens and the embedded-URL/helper credential work), falling back to the
+  `Authorization: token` header for a bare `GITEA_TOKEN`. Live-verified both paths
+  (env token; git credential helper as `kisfenyo`).
+
 ## 2026-06-17
 
 ### Added — `gitea-image-prune.sh`