[Fix] Gitea credentials expire after task wake-up

[roomote-roomote]

​Opened on behalf of @mrubens. Follow up by mentioning @roomote-roomote, in the web UI, or in Slack.

What changed

• Carry Gitea OAuth expiration through task credential creation and mixed-provider credential metadata.
• Schedule credential refresh before the earliest known provider expiration, including after a task resumes from sleep.
• Bound Gitea refresh requests and keep transient provider failures retryable while still requiring reauthorization for revoked refresh grants.
• Cover expiry propagation, mixed-provider scheduling, transient failures, revoked grants, and request timeouts with focused tests.

Why this change was made

Resumed tasks could reuse a Gitea token near the end of its lifetime and then wait for the fixed refresh interval, leaving Git operations unauthenticated after the token expired. Transient refresh failures could also incorrectly disable the deployment connection.

Impact

Gitea-backed tasks refresh credentials before expiration across fresh, resumed, and mixed-provider runs. Temporary Gitea outages remain retryable, and stalled refresh calls no longer block the credential loop indefinitely.

[roomote-community]

No code issues found. See task

_{Reviewed f499773}