gitea-image-prune.sh: auto-discover credentials from git

When GITEA_TOKEN/--token-file aren't set and the script runs inside a
Gitea-host clone, reuse git's stored credential: the token embedded in
the remote URL, else a configured credential helper (git credential fill,
no prompting). Switch to HTTP Basic auth (user:token) when a username is
known so both API tokens and the embedded-URL/helper credential work;
keep the token header for a bare GITEA_TOKEN. Banner reports the source.
Live-verified: env token + git credential helper (as kisfenyo) both list
and resolve OCI sizes.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

README.md

@@ -47,7 +47,23 @@ Confirmed live on Gitea 1.26.2 (2026-06-17), the reclaim path is **three steps**
 > accumulated orphan manifests on `felhom-hub` then freed **86 MiB**. After
 > reclaim, surviving tags (`latest`, `0.1.3`, …) still `docker pull` cleanly.
 
-### Token & required scopes
+### Credentials
+
+The script resolves credentials in this order:
+
+1. `GITEA_TOKEN` env var
+2. `--token-file <path>`
+3. **git's stored credential for the Gitea host** — auto-discovered when you run
+   the script inside a clone: first the token embedded in the remote URL
+   (`https://user:token@host/…`), else a configured **credential helper**
+   (`git credential fill`). No prompting.
+
+So from a configured clone you can just run `./gitea-image-prune.sh --repo … list`
+with no token at all. The startup banner prints which source was used. Caveat: a
+*git* credential may only carry repo scope — if it lacks package/admin scope, the
+call returns a 403 naming the missing scope (see below).
+
+### Required scopes
 
 Pass an admin-user token via `GITEA_TOKEN` (env) or `--token-file <path>`. The
 token must belong to a Gitea **site-admin** user. Minimal fine-grained scopes