feat(repo): split repository creation limit into user and org scopes (#37872)

## Background

`MAX_CREATION_LIMIT` applies to whoever owns a new repository, with no
distinction between individual users and organizations. Admins who want
different limits for the two - most commonly "block personal repos but
let orgs create freely" - currently have to set per-user / per-org
overrides on every entity.

## Changes

Adds two new `[repository]` settings:

- `USER_MAX_CREATION_LIMIT`: global limit for individual users
- `ORG_MAX_CREATION_LIMIT`: global limit for organizations

`MAX_CREATION_LIMIT` is kept as a shortcut: when set, it becomes the
default value for both new keys. When the new keys are explicitly
configured, they take precedence. Deployments that only set
`MAX_CREATION_LIMIT` see behavior identical to now.

Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>

modules/setting/repository_test.go

@@ -0,0 +1,66 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package setting
+
+import (
+	"testing"
+
+	"gitea.dev/modules/test"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestLoadRepositoryCreationLimits(t *testing.T) {
+	defer test.MockVariableValue(&Repository.MaxCreationLimit)()
+	defer test.MockVariableValue(&Repository.UserMaxCreationLimit)()
+	defer test.MockVariableValue(&Repository.OrgMaxCreationLimit)()
+
+	t.Run("ShortcutPropagatesToBoth", func(t *testing.T) {
+		cfg, err := NewConfigProviderFromData(`
+[repository]
+MAX_CREATION_LIMIT = 5
+`)
+		assert.NoError(t, err)
+		loadRepositoryFrom(cfg)
+		assert.Equal(t, 5, Repository.MaxCreationLimit)
+		assert.Equal(t, 5, Repository.UserMaxCreationLimit)
+		assert.Equal(t, 5, Repository.OrgMaxCreationLimit)
+	})
+
+	t.Run("PerTypeKeysOverrideShortcut", func(t *testing.T) {
+		cfg, err := NewConfigProviderFromData(`
+[repository]
+MAX_CREATION_LIMIT = 5
+USER_MAX_CREATION_LIMIT = 0
+ORG_MAX_CREATION_LIMIT = -1
+`)
+		assert.NoError(t, err)
+		loadRepositoryFrom(cfg)
+		assert.Equal(t, 0, Repository.UserMaxCreationLimit)
+		assert.Equal(t, -1, Repository.OrgMaxCreationLimit)
+	})
+
+	t.Run("PartialOverrideOtherInheritsShortcut", func(t *testing.T) {
+		cfg, err := NewConfigProviderFromData(`
+[repository]
+MAX_CREATION_LIMIT = 7
+ORG_MAX_CREATION_LIMIT = -1
+`)
+		assert.NoError(t, err)
+		loadRepositoryFrom(cfg)
+		assert.Equal(t, 7, Repository.UserMaxCreationLimit)
+		assert.Equal(t, -1, Repository.OrgMaxCreationLimit)
+	})
+
+	t.Run("NoKeyDefaultsToNoLimit", func(t *testing.T) {
+		cfg, err := NewConfigProviderFromData(`
+[repository]
+`)
+		assert.NoError(t, err)
+		loadRepositoryFrom(cfg)
+		assert.Equal(t, -1, Repository.MaxCreationLimit)
+		assert.Equal(t, -1, Repository.UserMaxCreationLimit)
+		assert.Equal(t, -1, Repository.OrgMaxCreationLimit)
+	})
+}