Add a git credential helper for Gitea, backed by tea's own login

Coder's GIT_ASKPASS only knows about github.com; for git.octoturge.com
it falls through to a broken interactive prompt, so `git push`/`pull`
over HTTPS hangs or fails even after `tea login add` succeeds. A
credential helper answering `git credential fill` runs before
GIT_ASKPASS is consulted, so wire one up (gated on the wizard's
existing DID_GITEA check) that reads the live OAuth token straight out
of tea's own credentials.json - verified end-to-end against a running
workspace (git ls-remote over HTTPS authenticated successfully).

Bump every template's VERSION to publish it.

templates/python/VERSION

@@ -1 +1 @@
-2
+3