feat: improve private repo access handling in web/sandbox flow

[bmdavis419]

Summary

• add cloud preflight for likely private/inaccessible repo URLs
• surface explicit auth-required guidance for cloud mode
• integrate with existing git auth path assumptions

Issues

• Closes BTCA + Private repos? #191

Greptile Summary

Adds early validation for private GitHub repositories during custom resource creation. The preflight check performs a HEAD request to detect if a repository is private/inaccessible and provides clear guidance to configure BTCA_GIT_TOKEN or use local CLI mode.

Key Changes:

• Implemented preflightResourceUrlAccess() to detect private/inaccessible GitHub repos before resource creation
• Added helpful error message directing users to configure BTCA_GIT_TOKEN for private repo access
• Integrated preflight check into addCustomResource mutation to fail early with actionable guidance

Observations:

• Check is limited to GitHub URLs only (GitLab, Bitbucket, etc. are not validated)
• Network/CORS errors during preflight are treated as success to avoid false positives
• Actual git operations will still fail with proper errors if repository is truly inaccessible

Confidence Score: 4/5

• This PR is safe to merge with minimal risk
• Well-implemented preflight check that improves UX by providing early feedback for private repos. Code follows existing patterns, uses proper error handling with better-result, and integrates cleanly with the addCustomResource mutation. The approach is conservative (allows on network errors) to avoid false positives.
• No files require special attention

Important Files Changed

Filename	Overview
apps/web/src/convex/resources.ts	Adds preflight check for private GitHub repos before resource creation, with helpful error messaging

_{Last reviewed commit: 02f8ada}