feat(lanes): git login from the dashboard, merge and conflict resolution (#45)

Part A — a fetch/pull/push against a remote that needs a login no longer
dies on "terminal prompts disabled": the server answers 409 EGITAUTH with
the host, the git bar asks for a username + password/access token and
resends the same action. AgentHub keeps its OWN credential store
(<CLAUDE_HOME>/agenthub-git-credentials/, 0700/0600), one login per host,
shared by every user of the install, managed from Settings -> Git
credentials. A login is only sent to one of the repo's own remote hosts,
saved only after git accepted it, never returned by any route, and reaches
git through an exclusive credential helper (never argv).

Part B — merge a branch (or the diverged upstream) from the git bar; a
merge that stops on conflicts lists them in the Changes panel with Keep
mine / Take theirs / Mark resolved, then Complete merge or Abort merge
(confirm gate). Clean tree, repo-root lane and an existing ref only;
pull/switch/hunk actions are blocked mid-merge; staging a conflicted file
with markers left is refused. Rebase/reset/stash stay out.

server/routes/lanes.js

@@ -973,6 +973,11 @@ router.post("/:id/git/:action", sameOriginGuard, async (req, res) => {
       "ESTAGEDOUTSIDE",
       "ENOREMOTE",
       "EUNTRACKED",
+      "EBADHOST",
+      "EBADCRED",
+      "ESUBDIR",
+      "EBADSIDE",
+      "EMARKERS",
     ];
     // A numeric code is git's own exit status (execFile reports one that way):
     // git ran and refused — a rejected push, a failed credential, a diverged
@@ -982,7 +987,7 @@ router.post("/:id/git/:action", sameOriginGuard, async (req, res) => {
     // EHUNKGONE is the same kind of answer: the tree moved under the click.
     const status = badRequest.includes(err.code)
       ? 400
-      : exited || err.code === "EHUNKGONE"
+      : exited || ["EHUNKGONE", "EGITAUTH", "EMERGING", "ENOMERGE", "ECONFLICTS"].includes(err.code)
         ? 409
         : 500;
     // git's own stderr is the useful half of a failed push or pull (a
@@ -994,6 +999,9 @@ router.post("/:id/git/:action", sameOriginGuard, async (req, res) => {
       error: {
         code: gitErrorCode(err),
         message: detail ? `${err.message}\n${detail}` : err.message,
+        // EGITAUTH: which host wants a login, for the git bar's form. Never
+        // a secret — just protocol, host, a username hint and `rejected`.
+        ...(err.auth ? { auth: err.auth } : {}),
       },
     });
   }