feat: base git/gnupg install + auto SSH/GPG key setup for external git

- Every template's coder_agent startup script now unconditionally
  installs git and gnupg as base packages (guarded on `command -v`, so
  it's a fast no-op where already present, e.g. templates/web's baked
  image). Not every base image ships gnupg by default.

- cli-setup-wizard.sh (all 6 templates) now tracks whether the user
  actually ended up authenticated against GitHub and/or Gitea via the
  existing gh/tea install-and-login prompts. If at least one succeeded,
  it asks once more whether to auto-generate an SSH key (ed25519) and a
  GPG signing key (ed25519, quick-gen) and register them with whichever
  host(s) are in play - stays completely silent for "local git only"
  (neither gh nor tea set up).

  - GitHub: `gh ssh-key add` / `gh gpg-key add` (official gh CLI
    subcommands).
  - Gitea: direct calls against `/api/v1/user/keys` and
    `/api/v1/user/gpg_keys`, reusing the token `tea login add` already
    stored in tea's config.yml (parsed with a small awk extractor).
  - Either upload failing (already added, API shape mismatch, etc.)
    just prints the manual command/URL and moves on - never blocks the
    rest of the wizard, consistent with every other step's style.
  - git is configured to sign commits with the new key
    (user.signingkey + commit.gpgsign) once a GPG key exists, whether
    freshly generated or already present from a prior run.

README updated to document both additions.

templates/web/main.tf

@@ -53,6 +53,14 @@ resource "coder_agent" "main" {
       touch ~/.init_done
     fi
 
+    # Ensure git and gnupg (commit signing) are present as base packages -
+    # not every base image ships gnupg by default. No-op once both are
+    # present (e.g. templates/web already bakes them into its image).
+    if ! command -v git >/dev/null 2>&1 || ! command -v gpg >/dev/null 2>&1; then
+      sudo apt-get update -qq
+      sudo apt-get install -y --no-install-recommends git gnupg
+    fi
+
     # Add any commands that should be executed at workspace startup (e.g install requirements, start a program, etc) here
   EOT