feat: git credential backend for credential storage (#371)

## Problem

Credentials were stored as plaintext JSON in
`stdpath('data')/cp-nvim.json`, with no integration with system
credential managers.

## Solution

Replace file-based credential storage with `git credential
fill/approve/reject`, delegating to whatever credential helper the user
has configured (`cache`, `store`, `libsecret`, macOS Keychain, etc.).

- New `lua/cp/git_credential.lua` module wrapping the git credential
protocol
- All credential consumers (`credentials.lua`, `submit.lua`,
`scraper.lua`) use `git_credential` directly — `cache.lua` no longer
handles credentials
- CSES API token packed into the password field (`password<TAB>token`)
so it works with helpers that ignore the `path` field
- `has_helper()` guard on `:CP login`, `:CP logout`, and `:CP submit`
with an error message if no helper is configured
- Healthcheck split into `[required]`/`[optional]` sections; git version
and credential helper status shown
- `git` checked at startup in `check_required_runtime()`
- Cache version system (`CACHE_VERSION`, v1→v2 migration) removed — the
cache file is now a plain JSON blob
- `:CP` command gets `bar = true`

lua/cp/health.lua

@@ -5,12 +5,12 @@ local utils = require('cp.utils')
 local function check()
   vim.health.start('cp.nvim [required] ~')
 
-  utils.setup_python_env()
-
+  local nvim_ver = vim.version()
+  local nvim_str = ('%d.%d.%d'):format(nvim_ver.major, nvim_ver.minor, nvim_ver.patch)
   if vim.fn.has('nvim-0.10.0') == 1 then
-    vim.health.ok('Neovim 0.10.0+ detected')
+    vim.health.ok('Neovim >= 0.10.0: ' .. nvim_str)
   else
-    vim.health.error('cp.nvim requires Neovim 0.10.0+')
+    vim.health.error('Neovim >= 0.10.0 required, found ' .. nvim_str)
   end
 
   local uname = vim.uv.os_uname()
@@ -18,6 +18,24 @@ local function check()
     vim.health.error('Windows is not supported')
   end
 
+  local time_cap = utils.time_capability()
+  if time_cap.ok then
+    vim.health.ok('GNU time found: ' .. time_cap.path)
+  else
+    vim.health.error('GNU time not found: ' .. (time_cap.reason or ''))
+  end
+
+  local timeout_cap = utils.timeout_capability()
+  if timeout_cap.ok then
+    vim.health.ok('GNU timeout found: ' .. timeout_cap.path)
+  else
+    vim.health.error('GNU timeout not found: ' .. (timeout_cap.reason or ''))
+  end
+
+  vim.health.start('cp.nvim [optional] ~')
+
+  utils.setup_python_env()
+
   if utils.is_nix_build() then
     local source = utils.is_nix_discovered() and 'runtime discovery' or 'flake install'
     vim.health.ok('Nix Python environment detected (' .. source .. ')')
@@ -51,18 +69,30 @@ local function check()
     end
   end
 
-  local time_cap = utils.time_capability()
-  if time_cap.ok then
-    vim.health.ok('GNU time found: ' .. time_cap.path)
-  else
-    vim.health.error('GNU time not found: ' .. (time_cap.reason or ''))
-  end
+  if vim.fn.executable('git') == 1 then
+    local r = vim.system({ 'git', '--version' }, { text = true }):wait()
+    if r.code == 0 then
+      local major, minor, patch = r.stdout:match('(%d+)%.(%d+)%.(%d+)')
+      major, minor, patch = tonumber(major), tonumber(minor), tonumber(patch or 0)
+      local ver_str = ('%d.%d.%d'):format(major or 0, minor or 0, patch or 0)
+      if
+        major
+        and (major > 1 or (major == 1 and minor > 7) or (major == 1 and minor == 7 and patch >= 9))
+      then
+        vim.health.ok('git >= 1.7.9: ' .. ver_str)
+      else
+        vim.health.warn('git >= 1.7.9 required for credential storage, found ' .. ver_str)
+      end
+    end
 
-  local timeout_cap = utils.timeout_capability()
-  if timeout_cap.ok then
-    vim.health.ok('GNU timeout found: ' .. timeout_cap.path)
+    local helper = vim.system({ 'git', 'config', 'credential.helper' }, { text = true }):wait()
+    if helper.code == 0 and helper.stdout and vim.trim(helper.stdout) ~= '' then
+      vim.health.ok('git credential helper: ' .. vim.trim(helper.stdout))
+    else
+      vim.health.warn('no git credential helper configured (required for login/submit)')
+    end
   else
-    vim.health.error('GNU timeout not found: ' .. (timeout_cap.reason or ''))
+    vim.health.warn('git not found (required for credential storage)')
   end
 end