refactor(forge): replace curl/token auth with CLI-native API calls

Problem: Forge metadata fetching required manual token management —
config fields, CLI token extraction, and curl with auth headers. Each
forge had a different auth path, and Codeberg had no CLI support at all.

Solution: Delete `get_token()` and `_api_url()`, replace with
`_api_args()` that builds `gh api`, `glab api`, or `tea api` arg
arrays. The CLIs handle auth internally. Add `warn_missing_cli` config
(default true) that warns once per forge per session on failure. Add
forge CLI checks to `:checkhealth`. Remove `token` from config/docs.

lua/pending/config.lua

@@ -34,13 +34,13 @@
 ---@field region? string
 
 ---@class pending.ForgeInstanceConfig
----@field token? string
 ---@field icon? string
 ---@field issue_format? string
 ---@field instances? string[]
 
 ---@class pending.ForgeConfig
 ---@field auto_close? boolean
+---@field warn_missing_cli? boolean
 ---@field github? pending.ForgeInstanceConfig
 ---@field gitlab? pending.ForgeInstanceConfig
 ---@field codeberg? pending.ForgeInstanceConfig
@@ -156,6 +156,7 @@ local defaults = {
   sync = {},
   forge = {
     auto_close = false,
+    warn_missing_cli = true,
     github = {
       icon = '',
       issue_format = '%i %o/%r#%n',

lua/pending/forge.lua

@@ -26,12 +26,22 @@ local FORGE_HOSTS = {
 }
 
 ---@type table<string, string>
-local FORGE_API_BASE = {
-  github = 'https://api.github.com',
-  gitlab = 'https://gitlab.com',
-  codeberg = 'https://codeberg.org',
+local FORGE_CLI = {
+  github = 'gh',
+  gitlab = 'glab',
+  codeberg = 'tea',
 }
 
+---@type table<string, string>
+local FORGE_AUTH_CMD = {
+  github = 'gh auth login',
+  gitlab = 'glab auth login',
+  codeberg = 'tea login add',
+}
+
+---@type table<string, boolean>
+local _warned_forges = {}
+
 ---@type table<string, string>
 local SHORTHAND_PREFIX = {
   gh = 'github',
@@ -230,37 +240,29 @@ function M.find_refs(text)
 end
 
 ---@param ref pending.ForgeRef
----@return string
-function M._api_url(ref)
+---@return string[]
+function M._api_args(ref)
   if ref.forge == 'github' then
-    return FORGE_API_BASE.github
-      .. '/repos/'
-      .. ref.owner
-      .. '/'
-      .. ref.repo
-      .. '/issues/'
-      .. ref.number
+    return {
+      'gh',
+      'api',
+      '/repos/' .. ref.owner .. '/' .. ref.repo .. '/issues/' .. ref.number,
+    }
   elseif ref.forge == 'gitlab' then
     local encoded = (ref.owner .. '/' .. ref.repo):gsub('/', '%%2F')
     local endpoint = ref.type == 'merge_request' and 'merge_requests' or 'issues'
-    return FORGE_API_BASE.gitlab
-      .. '/api/v4/projects/'
-      .. encoded
-      .. '/'
-      .. endpoint
-      .. '/'
-      .. ref.number
+    return {
+      'glab',
+      'api',
+      '/projects/' .. encoded .. '/' .. endpoint .. '/' .. ref.number,
+    }
   else
     local endpoint = ref.type == 'pull_request' and 'pulls' or 'issues'
-    return FORGE_API_BASE.codeberg
-      .. '/api/v1/repos/'
-      .. ref.owner
-      .. '/'
-      .. ref.repo
-      .. '/'
-      .. endpoint
-      .. '/'
-      .. ref.number
+    return {
+      'tea',
+      'api',
+      '/repos/' .. ref.owner .. '/' .. ref.repo .. '/' .. endpoint .. '/' .. ref.number,
+    }
   end
 end
 
@@ -287,49 +289,21 @@ function M.format_label(ref, cache)
   return text, hl
 end
 
----@param forge string
----@return string?
-function M.get_token(forge)
-  local cfg = config.get().forge or {}
-  local forge_cfg = cfg[forge] or {}
-  if forge_cfg.token then
-    return forge_cfg.token
-  end
-  if forge == 'github' then
-    local result = vim.fn.system({ 'gh', 'auth', 'token' })
-    if vim.v.shell_error == 0 and result and result ~= '' then
-      return vim.trim(result)
-    end
-  elseif forge == 'gitlab' then
-    local result = vim.fn.system({ 'glab', 'auth', 'token' })
-    if vim.v.shell_error == 0 and result and result ~= '' then
-      return vim.trim(result)
-    end
-  end
-  return nil
-end
-
 ---@param ref pending.ForgeRef
 ---@param callback fun(cache: pending.ForgeCache?)
 function M.fetch_metadata(ref, callback)
-  local token = M.get_token(ref.forge)
-  local url = M._api_url(ref)
-  local args = { 'curl', '-s', '-L' }
-  if token then
-    table.insert(args, '-H')
-    if ref.forge == 'gitlab' then
-      table.insert(args, 'PRIVATE-TOKEN: ' .. token)
-    else
-      table.insert(args, 'Authorization: Bearer ' .. token)
-    end
-  end
-  table.insert(args, '-H')
-  table.insert(args, 'Accept: application/json')
-  table.insert(args, url)
+  local args = M._api_args(ref)
 
   vim.system(args, { text = true }, function(result)
     if result.code ~= 0 or not result.stdout or result.stdout == '' then
       vim.schedule(function()
+        local forge_cfg = config.get().forge or {}
+        if forge_cfg.warn_missing_cli ~= false and not _warned_forges[ref.forge] then
+          _warned_forges[ref.forge] = true
+          local cli = FORGE_CLI[ref.forge]
+          local auth_cmd = FORGE_AUTH_CMD[ref.forge]
+          log.warn(('%s not found or not authenticated — run `%s`'):format(cli, auth_cmd))
+        end
         callback(nil)
       end)
       return

lua/pending/health.lua

@@ -46,6 +46,20 @@ function M.check()
     end
   end
 
+  vim.health.start('pending.nvim: forge')
+  local forge_clis = {
+    { cmd = 'gh', name = 'GitHub', hint = 'gh auth login' },
+    { cmd = 'glab', name = 'GitLab', hint = 'glab auth login' },
+    { cmd = 'tea', name = 'Codeberg', hint = 'tea login add' },
+  }
+  for _, cli in ipairs(forge_clis) do
+    if vim.fn.executable(cli.cmd) == 1 then
+      vim.health.ok(('%s found'):format(cli.cmd))
+    else
+      vim.health.warn(('%s not found — run `%s`'):format(cli.cmd, cli.hint))
+    end
+  end
+
   local sync_paths = vim.fn.globpath(vim.o.runtimepath, 'lua/pending/sync/*.lua', false, true)
   if #sync_paths == 0 then
     vim.health.info('No sync backends found')