kosmos
6468ae9638
`resolve_watch_token` handed the adapter a bare string, so the client could only ever try it as a token — and a `secret_kind` is a label the human typed at `identity_save`, not a fact: a login password saved as a token resolved as one, 401'd on every poll, and the watch stayed dead with nothing said. `resolve_watch_credential` returns the value *and* the login of the account it came from (`WatchCredential`), the client cache keys on both (one value sent two ways is two credentials), and the gitea client is built with `with_login`, so the adapter's 401 retry can reach the instance's own Basic-auth form. A row token or the forge's environment variable names no login, so those tiers resolve exactly as before: `WatchCredential::bare`, `login: None`. `resolve_watch_token` stays as the token half, for callers with no use for the login.