Make the Vault gitea creds path selectable

agentpr always read gitea/creds/unkin-agent from a bare const, so a service
like repospawner could not run it as its own Gitea identity.

- Replace the GiteaCredsPath const with a function: GITEA_CREDS_PATH when set,
  otherwise gitea/creds/<AGENT_LOGIN>. Unset env still resolves to
  gitea/creds/unkin-agent, so existing callers are unchanged.
- Thread the creds path through fetchGiteaToken/readGiteaCreds instead of
  reading a package-level const, and report it in the error messages.
- Make agentpr's help text login-agnostic and document both variables.

internal/agent/token.go

@@ -7,6 +7,7 @@ package agent
 
 import (
 	"os"
+	"strings"
 	"sync"
 )
 
@@ -16,12 +17,14 @@ const (
 	// DefaultRoleID is the agent AppRole role_id used when AGENT_APPROLE_ROLE_ID
 	// is unset. Login uses role_id only (no secret_id).
 	DefaultRoleID = "ababbcd3-9c77-5c6a-be2d-287fce9214a6"
-	// GiteaCredsPath is the Vault path that mints a scoped Gitea token.
-	GiteaCredsPath = "gitea/creds/unkin-agent"
+	// GiteaCredsPrefix is the Vault gitea secrets-engine creds prefix; the agent
+	// login is appended to it to form the path that mints a scoped Gitea token.
+	GiteaCredsPrefix = "gitea/creds/"
 	// DefaultGiteaURL is the Gitea base URL used when GITEA_URL is unset.
 	DefaultGiteaURL = "https://git.unkin.net"
-	// DefaultAgentLogin is the Gitea login of the agent whose own comments are
-	// ignored by watchpr. Overridable via AGENT_LOGIN.
+	// DefaultAgentLogin is the Gitea login the tools act as: it selects the Vault
+	// creds path, sets the agentws git identity and is the login whose own
+	// comments watchpr ignores. Overridable via AGENT_LOGIN.
 	DefaultAgentLogin = "unkin-agent"
 	// DefaultAuthentikURL is the Authentik base URL used when AUTHENTIK_URL is
 	// unset. identity.unkin.net has no DNS record; the k8s name is the real one.
@@ -53,8 +56,8 @@ func GiteaURL() string {
 	return DefaultGiteaURL
 }
 
-// AgentLogin returns the login whose comments watchpr ignores (env AGENT_LOGIN
-// or the default).
+// AgentLogin returns the Gitea login the tools act as (env AGENT_LOGIN or the
+// default).
 func AgentLogin() string {
 	if v := os.Getenv("AGENT_LOGIN"); v != "" {
 		return v
@@ -62,6 +65,17 @@ func AgentLogin() string {
 	return DefaultAgentLogin
 }
 
+// GiteaCredsPath returns the Vault path that mints a scoped Gitea token:
+// GITEA_CREDS_PATH when set, otherwise gitea/creds/<AgentLogin>. So a service
+// running as its own identity only has to set AGENT_LOGIN.
+func GiteaCredsPath() string {
+	// Trimmed because callers join this onto ".../v1/".
+	if v := strings.Trim(strings.TrimSpace(os.Getenv("GITEA_CREDS_PATH")), "/"); v != "" {
+		return v
+	}
+	return GiteaCredsPrefix + AgentLogin()
+}
+
 // AuthentikURL returns the configured Authentik base URL (env AUTHENTIK_URL or
 // the default).
 func AuthentikURL() string {
@@ -81,18 +95,18 @@ var (
 // and caching it in-process for the lifetime of the command.
 func GiteaToken() (string, error) {
 	tokenOnce.Do(func() {
-		tokenValue, tokenErr = fetchGiteaToken(VaultAddr(), RoleID())
+		tokenValue, tokenErr = fetchGiteaToken(VaultAddr(), RoleID(), GiteaCredsPath())
 	})
 	return tokenValue, tokenErr
 }
 
-// fetchGiteaToken performs the AppRole login and reads the Gitea creds. It is
-// separated from GiteaToken so tests can exercise it directly against an
-// httptest server without touching the process-wide cache.
-func fetchGiteaToken(vaultAddr, roleID string) (string, error) {
+// fetchGiteaToken performs the AppRole login and reads the Gitea creds at
+// credsPath. It is separated from GiteaToken so tests can exercise it directly
+// against an httptest server without touching the process-wide cache.
+func fetchGiteaToken(vaultAddr, roleID, credsPath string) (string, error) {
 	clientToken, err := approleLogin(vaultAddr, roleID)
 	if err != nil {
 		return "", err
 	}
-	return readGiteaCreds(vaultAddr, clientToken)
+	return readGiteaCreds(vaultAddr, clientToken, credsPath)
 }