feat: first-class GitLab connect, browse, and push-to-deploy (Phase 1)

[ThomasRbn]

Refs #75

Summary

Implements Phase 1 of #75: first-class GitLab as a peer source provider alongside GitHub.

Users can connect GitLab (OAuth or PAT, including self-hosted), browse groups/projects/branches in the Library, bind a project with gitProvider: "gitlab", clone private repos into the existing deploy pipeline, and auto-deploy on Push Hook deliveries.

This does not include Phase 2 (commit statuses, per-server GitLab tokens) or Phase 3 (MR preview environments).

What’s included

Connect

• Settings → GitLab card: OAuth Application and/or personal access token
• Self-hosted: per-user GitLab URL on PAT connect (plus instance-wide GITLAB_BASE_URL)
• Disconnect clears Openship-side OAuth/PAT state without touching GitHub

Library / bind

• Library provider picker: GitHub | GitLab
• List namespaces and projects (nested groups supported)
• Bind sets gitProvider: "gitlab", owner/repo path, branch, clone URL, and numeric GitLab project id (installationId)
• URL import accepts GitLab HTTPS/SSH URLs

Push-to-deploy

• Registers a project Push Hook when a reachable webhook URL exists
• POST /api/webhooks/gitlab with X-Gitlab-Token verification and delivery idempotency
• Pushes to the tracked branch trigger the existing deploy path; other branches do not

Clone / deploy

• HTTPS clone via oauth2:<token> (project clone token → user PAT → OAuth)
• Never falls back to a GitHub credential for gitProvider=gitlab
• Adapters support custom HTTPS clone usernames (needed for GitLab oauth2)

Docs

• apps/web/content/docs/guides/deploy-from-gitlab.mdx
• apps/web/content/docs/api/gitlab.mdx
• apps/web/content/docs/troubleshooting/gitlab.mdx

Config

GITLAB_CLIENT_ID=
GITLAB_CLIENT_SECRET=
GITLAB_BASE_URL=https://gitlab.com   # or self-hosted origin
GITLAB_WEBHOOK_SECRET=               # optional instance fallback

[Hydralerne]

Huge, thank you, will review and merge asap

[Hydralerne]

thank you for the pr, there's some issues before merge i hope to fix before merge

1. SSRF via the self-hosted base URL — gitlab.http.ts normalizeGitlabBaseUrl allows http:// and any host, applies none of the repo's CLOUD_MODE-gated ssrf-guard; connect fetches the user-supplied baseUrl with a Bearer token before saving. Critical on the SaaS (CLOUD_MODE); low on single-tenant self-hosted (operator points at their own GitLab). Two agents + me.
2. OAuth "connect" is dead (guaranteed 500) — connectRedirect is a .public() route (no authMiddleware, verified in secure-router.ts:151) yet calls getRequestContext(c), which throws when ctx is absent → every call 500s; the ctx var is then unused. Also drops better-auth's OAuth state cookie (no asResponse/Set-Cookie forwarding). Only PAT connect works. Verified end-to-end.
3. Cross-org clone-token IDOR — getCloneToken takes a caller-supplied ?projectId → readProjectToken → non-org-scoped findById → returns any project's decrypted long-lived token. Worse: cloneTokenEncrypted is provider-agnostic, so it can even leak a GitHub project's PAT. Constrained by random UUIDs, but a genuine missing authz check (GitHub's version takes no project id and mints owner-scoped). Two agents + me.
4. Multi-member GitLab deploy is silently blocked — build.service.ts runs assertGitHubRepoAccess on every deploy/redeploy/build-access unconditionally; it's GitHub-grant-only, so a non-owner member (even with the new gitlab grant) hits GITHUB_ACCESS_DENIED 403 on a GitLab project. Fail-closed (over-restriction, not a breach); owner + webhook bypass, so single-owner self-hosted works — but it breaks the multi-user story Phase 1 advertises. Verified.
5. Missing drizzle snapshots 0057/0058 → next drizzle-kit generate re-emits a duplicate migration.
6. i18n bypass — new GitLab UI is hardcoded English (no useI18n), unlike GitHub siblings.

[ThomasRbn]

Great, thanks for your feedback, I'll take a look on this whenever I can 👀

[Hydralerne]

perfect, but anyway really great work