Spec 0009 D5. Supplies NewProviderAt, so the harness can point this provider at
a server it controls and prove each refusal is named with the right sentinel
rather than trusting that the mapping in refusal.go is reached from the release
paths.

Also declares MissingTag. buildServer already 404s a tag it has no release for,
so the release-not-found sentinel is now checked rather than assumed — the field
was accepted by the config and consumed only by the logging check.

Both source types run the checks, which is what proves the mapping is not
somewhere the Gitea/Forgejo split could skip.

Requires forge v0.14.0 for NewProviderAt.

Spec 0008 D4. forge has exposed WithHTTPTransport and WithHTTPClient since
v0.13.0 and this adapter read neither: the factory took opts ...forge.Option,
consulted Options.Logger, and dropped the rest. A consumer injecting a transport
to share a connection pool got no effect and no error.

Settings gains HTTPTransport and HTTPClient, both registrations' factory copies
them from the options, and client construction goes through one of two helpers:

  - apiClient honours both rungs, preferring a supplied client, which is the
    precedence forge.Options documents. It builds the SDK client.
  - pooledClient shares a supplied transport and DELIBERATELY IGNORES a supplied
    client. It builds the download client.

The split is a security decision. An asset download fetches a URL the release
AUTHOR chose, and this provider attaches its Authorization header only when
forge.HostTrusted approves the target — relying on the redirect being handled by
a client that will not carry it onward, which
TestGiteaProvider_DownloadAsset_TokenNotForwardedAcrossRedirect already pins.

A caller's client may also carry credentials of its own, in headers the standard
library does not know to strip: it protects Authorization, Cookie and
WWW-Authenticate on a cross-host redirect, and nothing else. A custom header
follows. We cannot inspect a supplied client to find out, so the download keeps
a client this adapter built. The transport is still shared, so no pooling is
lost.

Every behaviour is falsified against the mutant that removes it. Making
pooledClient prefer the supplied client fails TestTheDownloadIsNeverTheSuppliedClient
with "the consumer's credential reached an author-chosen asset host", and
dropping the factory wiring is caught only by TestTheRungsReachThroughTheRegistry
— the path most consumers use.