Maps Gitea's responses onto the forge sentinels released in v0.13.0, so a
caller can tell a missing release from a lapsed credential from a
permission failure from a rate limit.

This is a status mapping rather than a type switch, because the SDK
exposes no typed error for any of them — unlike go-github, which parses
rate limits into their own types. The response's status is the only
evidence available, so refuse takes the response rather than inspecting
the error.

Gitea and Forgejo answer a rate limit with 429, which is the
straightforward case. An exhausted budget advertised on a 403 is honoured
too, for an instance behind a proxy that reports GitHub-style: checked
BEFORE concluding permission, because telling a throttled caller it lacks
permission sends it looking for a grant it already has — and a caller
treating forbidden as a credential problem would re-resolve into an API
that is already refusing.

wrapNotFound now delegates rather than doing its own 404 check, so its
twelve call sites across discovery and issues gain the new refusals
untouched.

The asset download holds a plain net/http response rather than an SDK one,
so it maps through refuseRaw. Split rather than generalised: the two carry
different types, and collapsing them would mean converting a response just
to read two fields. A download is refused for the same reasons an API call
is, and a caller branching on the sentinels should not have to
special-case that path.

Release paths carry ErrReleaseNotFound; an unmapped status stays an
ordinary error rather than being forced into one of the four.

Implements forge spec 0009 D1, D2, D3 and D7 for this adapter.