fix: branches endpoint with SSH auth for remote fallback + better error messages

Backend (git_repositories.py):
- get_repository_branches: check for .git dir OR HEAD file (handles bare repos)
- When local repo is missing, git ls-remote fallback now uses SSH key auth
  via _prepare_ssh_env() for repos with ssh_key_id
- Cleans up temp SSH key file after ls-remote
- Logs ls-remote stderr/exit code for debugging
- Returns server's detail message instead of raw axios 404 text

Frontend (use-git-repo.ts):
- extractError() helper pulls server detail/message from axios responses
- User sees 'repository not found on disk — re-clone or re-create'
  instead of generic 'Request failed with status code 404'

Quality gates: ruff clean, tsc --noEmit clean, 11 passed + 1 pre-existing failure

apps/web/src/hooks/use-git-repo.ts

@@ -93,6 +93,18 @@ export function useGitRepo(
 	const [loading, setLoading] = useState(false);
 	const [error, setError] = useState<string | null>(null);
 
+	const extractError = (err: unknown): string => {
+		if (typeof err === "object" && err !== null) {
+			const e = err as Record<string, unknown>;
+			const response = e.response as Record<string, unknown> | undefined;
+			const data = response?.data as Record<string, unknown> | undefined;
+			if (typeof data?.detail === "string") return data.detail;
+			if (typeof data?.message === "string") return data.message;
+			if (typeof e.message === "string") return e.message;
+		}
+		return "Git operation failed";
+	};
+
 	const withLoading = useCallback(
 		async <T>(fn: () => Promise<T>): Promise<T> => {
 			setLoading(true);
@@ -100,8 +112,7 @@ export function useGitRepo(
 			try {
 				return await fn();
 			} catch (err) {
-				const msg = err instanceof Error ? err.message : "Git operation failed";
-				setError(msg);
+				setError(extractError(err));
 				throw err;
 			} finally {
 				setLoading(false);