refactor: Use HTTP Basic Auth instead of tokens for package uploads

- Replace token-based auth with HTTP Basic Auth (username/password)
- Scripts now use FORGEJO_USER and FORGEJO_PASS environment variables
- Same credentials used for git repository access
- No special token creation needed
- Simpler setup: set env vars and run upload script
- Both Windows and macOS scripts updated

FORGEJO_PACKAGES_SETUP.md

@@ -15,47 +15,25 @@ This guide explains how to distribute WebDrop Bridge builds using **Forgejo Pack
 
 ## Setup Requirements
 
-### 1. Forgejo Personal Access Token
+### 1. Use Your Existing Forgejo Credentials
 
-Create a token with package write permissions:
+You already have HTTP access to Forgejo. Just use the same username and password you use to log in.
 
-1. Go to: https://git.him-tools.de/user/settings/applications
-2. Click "Generate New Token"
-3. Name: `BUILD_UPLOAD_TOKEN`
-4. Scopes: Check `write:package`, `api`
-5. Click "Generate Token"
-6. Copy the token
+Set environment variables with your Forgejo credentials:
 
-### 2. Store Token Securely
-
-Choose one of these methods:
-
-**Option A: Environment Variable (Simplest)**
+**Windows (PowerShell):**
 ```powershell
-# Windows PowerShell
-$env:FORGEJO_TOKEN = "your_token_here"
+$env:FORGEJO_USER = "your_forgejo_username"
+$env:FORGEJO_PASS = "your_forgejo_password"
 ```
 
-**Option B: Credential Manager (Windows - Most Secure)**
-```powershell
-.\build\scripts\upload_to_packages.ps1 -SaveToken -ForgejoToken "your_token_here"
-# Token is encrypted and stored for future use
-```
-
-**Option C: Config File**
+**macOS/Linux:**
 ```bash
-# macOS/Linux - Save to home directory
-bash build/scripts/upload_to_packages.sh --save-token -t "your_token_here"
-# Saved to ~/.config/webdrop-bridge/.env (chmod 600)
+export FORGEJO_USER="your_forgejo_username"
+export FORGEJO_PASS="your_forgejo_password"
 ```
 
-**Option D: Project .env (Development Only)**
-Create `.env` in project root and add to `.gitignore`:
-```
-FORGEJO_TOKEN=your_token_here
-```
-
-### 3. Build Scripts
+### 2. Build Scripts
 
 Upload scripts are already created:
 - Windows: `build/scripts/upload_to_packages.ps1`
@@ -83,23 +61,23 @@ bash build/scripts/build_macos.sh
 
 ### Step 2: Upload to Packages
 
-After storing your token (see Setup Requirements above), uploading is simple:
+After setting your environment variables (see Setup Requirements above), uploading is simple:
 
 **Windows Upload:**
 ```powershell
+$env:FORGEJO_USER = "your_username"
+$env:FORGEJO_PASS = "your_password"
 .\build\scripts\upload_to_packages.ps1 -Version 1.0.0
 ```
 
 **macOS Upload:**
 ```bash
+export FORGEJO_USER="your_username"
+export FORGEJO_PASS="your_password"
 bash build/scripts/upload_to_packages.sh -v 1.0.0
 ```
 
-The scripts will automatically find your token from:
-1. `-ForgejoToken` / `-t` parameter (if provided)
-2. `$env:FORGEJO_TOKEN` / `$FORGEJO_TOKEN` environment variable
-3. Windows Credential Manager / `~/.config/webdrop-bridge/.env`
-4. Project `.env` file
+Or set the environment variables once and they persist for all future uploads in that terminal session.
 
 ### Step 3: Tag and Commit
 
@@ -193,30 +171,27 @@ async def check_for_updates(self) -> Optional[UpdateInfo]:
 
 **Basic Usage:**
 ```powershell
-# After storing token (see Setup Requirements)
-.\build\scripts\upload_to_packages.ps1 -Version 1.0.0
-```
+# Set your Forgejo credentials
+$env:FORGEJO_USER = "your_username"
+$env:FORGEJO_PASS = "your_password"
 
-**First time setup - Save token to Credential Manager:**
-```powershell
-.\build\scripts\upload_to_packages.ps1 -SaveToken -ForgejoToken "your_token"
-# Then future uploads just need version
+# Upload
 .\build\scripts\upload_to_packages.ps1 -Version 1.0.0
 ```
 
 **Parameters:**
 - `-Version` - Version number (required, e.g., "1.0.0")
-- `-ForgejoToken` - Personal access token (optional if stored)
-- `-SaveToken` - Save token to Credential Manager
+- `-ForgejoUser` - Forgejo username (optional if `$env:FORGEJO_USER` set)
+- `-ForgejoPW` - Forgejo password (optional if `$env:FORGEJO_PASS` set)
 - `-ForgejoUrl` - Forgejo server URL (default: https://git.him-tools.de)
 - `-Repo` - Repository (default: HIM-public/webdrop-bridge)
 - `-ExePath` - Path to exe file (default: build\dist\windows\WebDropBridge.exe)
 - `-ChecksumPath` - Path to checksum file
 
 **Script flow:**
-1. Check for token in: parameter → environment → Credential Manager
+1. Check for credentials in: parameter → environment variables
 2. Verify exe and checksum files exist
-3. Upload exe to Packages API
+3. Upload exe to Packages API with HTTP Basic Auth
 4. Upload checksum to Packages API
 5. Show success message with package URL
 
@@ -224,41 +199,31 @@ async def check_for_updates(self) -> Optional[UpdateInfo]:
 
 **Basic Usage:**
 ```bash
-# After storing token (see Setup Requirements)
-bash build/scripts/upload_to_packages.sh -v 1.0.0
-```
+# Set your Forgejo credentials
+export FORGEJO_USER="your_username"
+export FORGEJO_PASS="your_password"
 
-**First time setup - Save token to config:**
-```bash
-bash build/scripts/upload_to_packages.sh --save-token -t "your_token"
-# Then future uploads just need version
+# Upload
 bash build/scripts/upload_to_packages.sh -v 1.0.0
 ```
 
 **Options:**
 - `-v, --version` - Version number (required, e.g., "1.0.0")
-- `-t, --token` - Personal access token (optional if stored)
-- `--save-token` - Save token to ~/.config/webdrop-bridge/.env
 - `-u, --url` - Forgejo server URL (default: https://git.him-tools.de)
 
 **Script flow:**
-1. Check for token in: parameter → environment → ~/.config/webdrop-bridge/.env → project .env
+1. Check for credentials in: environment variables (`$FORGEJO_USER`, `$FORGEJO_PASS`)
 2. Verify dmg and checksum files exist
-3. Upload dmg to Packages API
+3. Upload dmg to Packages API with HTTP Basic Auth
 4. Upload checksum to Packages API
 5. Show success message with package URL
 
-### Token Resolution Order
+### Credential Resolution
 
-Both scripts check for tokens in this priority:
-1. **Parameter**: `-ForgejoToken "token"` (PowerShell) or `-t "token"` (Bash)
-2. **Environment**: `$env:FORGEJO_TOKEN` (PowerShell) or `$FORGEJO_TOKEN` (Bash)
-3. **Stored Config**:
-   - Windows: Credential Manager (via `-SaveToken` flag)
-   - macOS/Linux: `~/.config/webdrop-bridge/.env`
-4. **Project File**: `.env` in project root (if exists)
-
-This design matches how git handles credentials!
+Both scripts use HTTP Basic Authentication with your Forgejo username/password:
+- Same credentials you use to log into Forgejo
+- Same credentials git uses when cloning over HTTPS
+- No special token creation needed
 
 ## Complete Release Checklist