feat: support private repo cloning with HTTP basic auth

- Add SSH URL detection with friendly prompt to use HTTPS instead
- Add private repo toggle (default off) with username/password fields
- Persist auth_type and credential in repositories table
- Pass stored credentials to PullRepo for authenticated pulls
- Incremental migration adds auth_type and credential columns

database/db.go

@@ -99,6 +99,14 @@ func (db *DB) migrate() error {
 			return err
 		}
 	}
+	// Incremental migrations — ignore "duplicate column" errors for idempotency.
+	alterStmts := []string{
+		"ALTER TABLE repositories ADD COLUMN auth_type VARCHAR(20) NOT NULL DEFAULT 'none'",
+		"ALTER TABLE repositories ADD COLUMN credential TEXT",
+	}
+	for _, s := range alterStmts {
+		db.conn.Exec(s) // ignore error (column already exists)
+	}
 	return nil
 }