Add PAT authentication for git wiki sync; rebuild devcontainer on MCR node base

[aniongithub]

Summary

Two related changes, developed together in a rebuilt devcontainer:

1. PAT authentication for git wiki sync — let users/agents provide a personal access token to authenticate HTTPS git sync when the machine's own git credentials (gh, keychain, SSH) aren't usable. This is the required mechanism for 2FA accounts, where a PAT stands in for password+2FA at push time.
2. Devcontainer restructure onto a prebuilt MCR base image, so the build no longer fetches the toolchain from the public npm registry.

PAT authentication

• config: Token on SyncConfig (global default) and SyncMapping (per-remote override); TokenForRemote resolution (mapping → default → none) and AddMappingFull that preserves a stored token when none is supplied.
• sync: inject the token via a GIT_ASKPASS helper on fetch/push only, so it never lands in .git/config, the remote URL, or a process argument. Resets the inherited credential-helper chain so a broken helper can't shadow it, and scrubs the token from surfaced errors and logs.
• mcp: optional token on register_sync via a new SyncRegistrarWithToken interface with graceful fallback; updated tool description.
• httpapi: redact tokens in the settings API (never echo the raw value); re-saving the mask preserves the stored token, empty clears, a new value replaces.
• webui: password-style token field under Default Remote, plus a live Sync Status panel that surfaces per-remote last-sync/errors/conflicts from the previously-unused /api/sync/status endpoint.

Falls back to existing git credentials when no token is set, so existing setups are unaffected.

Security notes

• Token is passed to git fd-to-fd via GIT_ASKPASS (env var), never written to disk or ps-visible args.
• Settings API is redaction-only: GET/PUT return ********; the raw value lives only in the local ~/.mind-map/config.json (0600).
• Errors and logs are scrubbed. Verified via a live server smoke test (mask in/secret on disk, error surfaced, no token in logs).

Devcontainer restructure

• FROM mcr.microsoft.com/devcontainers/javascript-node:22-bookworm — node/npm ship in the image layers instead of being fetched from the npm registry during the build.
• Drop the node feature (base provides it) and the playwright feature (which pulled the node feature back in via dependsOn). Chromium for PDF export now comes from Debian apt and is auto-detected on PATH by chromedp.
• Keep the go feature (installs from go.dev) and sshd. Use the base image's native non-root node user; update the home mount target and postCreate.
• Pass NPM_CONFIG_REGISTRY through from the host via remoteEnv so machines behind a corporate npm proxy can still install webui deps at postAttach. References npm's standard variable, not a hardcoded URL, so it's empty and harmless on public/CI machines.

Testing

• Full go test ./... passes in a clean rebuild of the devcontainer, including internal/share (PDF export driving Chromium).
• New tests: token resolution + preservation (config), GIT_ASKPASS behavior incl. token-not-on-disk (sync), and the settings redaction round-trip (httpapi).
• Verified the remoteEnv chain end-to-end and the .mind-map home mount for the node user.