feat(gitea): support extra outbound HTTP headers via GITEA_EXTRA_HEADERS

Add a GITEA_EXTRA_HEADERS environment variable that accepts a JSON
object of header name/value pairs (e.g. Cloudflare Access
credentials) and applies them to every outbound request to Gitea,
both the raw pkg/gitea.DoJSON/DoBytes path and the SDK-backed
pkg/gitea.NewClient path, without overriding Authorization,
Content-Type, or Accept.

Co-Authored-By: Codet <codet@commitgo.dev> (GPT-5-Codex)

pkg/gitea/gitea_test.go

@@ -0,0 +1,49 @@
+package gitea
+
+import (
+	"context"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"gitea.com/gitea/gitea-mcp/pkg/flag"
+)
+
+func TestNewClient_SendsExtraHeaders(t *testing.T) {
+	var gotClientID, gotAuthorization string
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		gotClientID = r.Header.Get("CF-Access-Client-Id")
+		gotAuthorization = r.Header.Get("Authorization")
+		w.Header().Set("Content-Type", "application/json")
+		w.WriteHeader(http.StatusOK)
+		_, _ = w.Write([]byte(`{"login":"octocat"}`))
+	}))
+	defer srv.Close()
+
+	origHost := flag.Host
+	origExtraHeaders := flag.ExtraHeaders
+	defer func() {
+		flag.Host = origHost
+		flag.ExtraHeaders = origExtraHeaders
+	}()
+	flag.Host = srv.URL
+	flag.ExtraHeaders = http.Header{
+		"Cf-Access-Client-Id": []string{"client-id"},
+		"Authorization":       []string{"should-not-override"},
+	}
+
+	client, err := NewClient("the-token")
+	if err != nil {
+		t.Fatalf("NewClient returned error: %v", err)
+	}
+	if _, _, err := client.Users.GetMyUserInfo(context.Background()); err != nil {
+		t.Fatalf("GetMyUserInfo returned error: %v", err)
+	}
+
+	if gotClientID != "client-id" {
+		t.Fatalf("CF-Access-Client-Id header = %q, want %q", gotClientID, "client-id")
+	}
+	if gotAuthorization != "token the-token" {
+		t.Fatalf("Authorization header = %q, want %q", gotAuthorization, "token the-token")
+	}
+}