fix(server): apply the selected GitHub account to all network git operations

[enisze]

Problem

Per-project GitHub account switching was opt-in per call site, and the paths that mattered most never opted in. When a project had an account attached, only push and gh used its token. The background fetch that refreshes the branch list / ahead-behind counts (fetchRemoteForStatus), git pull, and several fetch* variants ran with no account token and authenticated as whichever account gh auth switch last made active machine-wide — forcing a manual gh auth switch just to see the right branches.

Changes

• Centralize network-git auth (GitVcsDriverCore.ts): new resolveNetworkGitEnv, and every remote-touching git command now routes through it — status fetch, pull, push, and all fetch* variants — so account selection can't be silently skipped by a call site that forgot to opt in.
• SSH→HTTPS rewrite (GitHubAccountResolver.ts): gitHubAccountAuthEnv adds a process-scoped url.https://<host>/.insteadOf for git@<host>: and ssh://git@<host>/, so the account token applies even for SSH remotes. The stored remote URL is untouched.
• Surface unusable accounts (contracts + GitHubSourceControlProvider.ts + SidebarV2.tsx): the per-account failure reason from gh auth status was parsed but dropped; it now flows through a new optional authError field, and the GitHub account selector warns when the selected account's token is expired/revoked instead of silently falling back to the default.
• Docs updated to match (network-git + SSH behavior, the new warning, commit-authorship caveat).

Commit authorship is intentionally left on local git config (user.name/user.email).

Testing

• pnpm typecheck — clean (0 errors)
• Server + contracts test suites pass (288 + 210); updated GitHubAccountResolver.test.ts and Manager.test.ts for the new GIT_CONFIG pairs.
• Lint not run locally (its oxlint plugin requires Node 24; this box is on Node 22).

🤖 Generated with Claude Code