fix: SSH auth for workspace sync (fetch/pull/branch check)

- GitService.fetch(), pull(), branch_exists_remotely() now accept ssh_key param
- WorkspaceManager.sync() loads repo SSH key from DB via session
- sync_workspace endpoint passes session to manager.sync()

Quality gates: ruff clean, pytest workspaces API (9 passed, 1 skipped)

apps/api/src/services/git_service.py

@@ -79,75 +79,96 @@ class GitService:
                 os.unlink(key_path)
 
     @staticmethod
-    async def fetch(path: str) -> None:
+    async def fetch(path: str, ssh_key: str | None = None) -> None:
         """Fetch from origin.
 
         Args:
             path: The path to the local git repository.
+            ssh_key: Optional decrypted SSH private key for authentication.
 
         Raises:
             RuntimeError: If fetch fails.
         """
-        proc = await asyncio.create_subprocess_exec(
-            "git",
-            "-C",
-            path,
-            "fetch",
-            "origin",
-            stdout=asyncio.subprocess.PIPE,
-            stderr=asyncio.subprocess.PIPE,
-        )
-        stdout, stderr = await proc.communicate()
-        if proc.returncode != 0:
-            error_msg = stderr.decode().strip() if stderr else "unknown error"
-            logger.error("Git fetch failed: %s", error_msg)
-            raise RuntimeError(f"Git fetch failed: {error_msg}")
-        logger.debug("Fetched origin for %s", path)
+        env, key_path = GitService._prepare_ssh_env(ssh_key)
+        try:
+            proc = await asyncio.create_subprocess_exec(
+                "git",
+                "-C",
+                path,
+                "fetch",
+                "origin",
+                stdout=asyncio.subprocess.PIPE,
+                stderr=asyncio.subprocess.PIPE,
+                env={**os.environ, **env} if env else None,
+            )
+            stdout, stderr = await proc.communicate()
+            if proc.returncode != 0:
+                error_msg = stderr.decode().strip() if stderr else "unknown error"
+                logger.error("Git fetch failed: %s", error_msg)
+                raise RuntimeError(f"Git fetch failed: {error_msg}")
+            logger.debug("Fetched origin for %s", path)
+        finally:
+            if key_path and os.path.exists(key_path):
+                os.unlink(key_path)
 
     @staticmethod
-    async def pull(path: str, branch: str) -> None:
+    async def pull(path: str, branch: str, ssh_key: str | None = None) -> None:
         """Pull latest changes from origin.
 
         Args:
             path: The path to the local git repository.
             branch: The branch to pull.
+            ssh_key: Optional decrypted SSH private key for authentication.
 
         Raises:
             RuntimeError: If pull fails.
         """
-        proc = await asyncio.create_subprocess_exec(
-            "git",
-            "-C",
-            path,
-            "pull",
-            "origin",
-            branch,
-            stdout=asyncio.subprocess.PIPE,
-            stderr=asyncio.subprocess.PIPE,
-        )
-        stdout, stderr = await proc.communicate()
-        if proc.returncode != 0:
-            error_msg = stderr.decode().strip() if stderr else "unknown error"
-            logger.error("Git pull failed: %s", error_msg)
-            raise RuntimeError(f"Git pull failed: {error_msg}")
-        logger.debug("Pulled origin/%s for %s", branch, path)
+        env, key_path = GitService._prepare_ssh_env(ssh_key)
+        try:
+            proc = await asyncio.create_subprocess_exec(
+                "git",
+                "-C",
+                path,
+                "pull",
+                "origin",
+                branch,
+                stdout=asyncio.subprocess.PIPE,
+                stderr=asyncio.subprocess.PIPE,
+                env={**os.environ, **env} if env else None,
+            )
+            stdout, stderr = await proc.communicate()
+            if proc.returncode != 0:
+                error_msg = stderr.decode().strip() if stderr else "unknown error"
+                logger.error("Git pull failed: %s", error_msg)
+                raise RuntimeError(f"Git pull failed: {error_msg}")
+            logger.debug("Pulled origin/%s for %s", branch, path)
+        finally:
+            if key_path and os.path.exists(key_path):
+                os.unlink(key_path)
 
     @staticmethod
-    def branch_exists_remotely(path: str, branch: str) -> bool:
+    def branch_exists_remotely(path: str, branch: str, ssh_key: str | None = None) -> bool:
         """Check if a branch exists on the remote.
 
         Args:
             path: The path to the local git repository.
             branch: The branch name to check.
+            ssh_key: Optional decrypted SSH private key for authentication.
 
         Returns:
             True if the branch exists on origin, False otherwise.
         """
-        result = subprocess.run(
-            ["git", "-C", path, "ls-remote", "--heads", "origin", branch],
-            capture_output=True,
-            text=True,
-        )
-        exists = result.returncode == 0 and result.stdout.strip() != ""
-        logger.debug("Branch %s exists on remote: %s", branch, exists)
-        return exists
+        env, key_path = GitService._prepare_ssh_env(ssh_key)
+        try:
+            result = subprocess.run(
+                ["git", "-C", path, "ls-remote", "--heads", "origin", branch],
+                capture_output=True,
+                text=True,
+                env={**os.environ, **env} if env else None,
+            )
+            exists = result.returncode == 0 and result.stdout.strip() != ""
+            logger.debug("Branch %s exists on remote: %s", branch, exists)
+            return exists
+        finally:
+            if key_path and os.path.exists(key_path):
+                os.unlink(key_path)