feat: add deploy tokens (#37306)

Deploy keys only work over SSH. A deploy token is their counterpart for HTTPS: a repository scoped credential, used as the password of a Git request, with read or read and write access. It covers Git operations and LFS, and can be regenerated in place.

Signed-off-by: silverwind <me@silverwind.io>
Co-authored-by: Claude Mythos <noreply@anthropic.com>
Co-authored-by: silverwind <me@silverwind.io>
Co-authored-by: bircni <bircni@icloud.com>
Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>

routers/private/key.go

@@ -7,7 +7,7 @@ import (
 	"net/http"
 
 	asymkey_model "gitea.dev/models/asymkey"
-	"gitea.dev/modules/timeutil"
+	deploykey_model "gitea.dev/models/deploykey"
 	"gitea.dev/services/context"
 )
 
@@ -20,17 +20,16 @@ func UpdatePublicKeyInRepo(ctx *context.PrivateContext) {
 		return
 	}
 
-	deployKey, err := asymkey_model.GetDeployKeyByRepoPublicKey(ctx, repoID, keyID)
+	deployKey, err := deploykey_model.GetDeployKeyByRepoPublicKey(ctx, repoID, keyID)
 	if err != nil {
-		if asymkey_model.IsErrDeployKeyNotExist(err) {
+		if deploykey_model.IsErrDeployKeyNotExist(err) {
 			ctx.PlainText(http.StatusOK, "success")
 			return
 		}
 		ctx.PrivateInternalErrorf("%v", err)
 		return
 	}
-	deployKey.UpdatedUnix = timeutil.TimeStampNow()
-	if err = asymkey_model.UpdateDeployKeyCols(ctx, deployKey, "updated_unix"); err != nil {
+	if err = deploykey_model.UpdateDeployKeyLastUsed(ctx, deployKey.ID); err != nil {
 		ctx.PrivateInternalErrorf("%v", err)
 		return
 	}