fix(git-sync): address PR #119 review #2 — throttle /git Basic auth, fix mcp schema drift + warnings/tests

Must-fix:
- Throttle the raw /git HTTP-Basic path: it bypasses Nest/ThrottlerGuard, so
  verifyUserCredentials (bcrypt) ran unthrottled. Wrap it in the SAME
  FailedLoginLimiter the /mcp path uses (5/60s; per-IP, per-IP+email, global
  per-email keys; atomic tryReserve BEFORE bcrypt; success resets, non-credential
  errors release). The (threshold+1)-th attempt now gets 429 pre-bcrypt. Sweep
  timer + onModuleDestroy mirror McpService.
- Fix the mcp schema mirror drift: packages/mcp details `open` attr now reads via
  hasAttribute (matches editor-ext canon + git-sync copy); getAttribute dropped a
  bare `<details open>` state. (build/ is gitignored — rebuilt locally.)

Tests added:
- /git brute-force throttle: pre-bcrypt 429 on the 6th failure; success resets;
  non-credential error releases the budget.
- git-http-backend lost-lock AbortSignal: already-aborted -> no spawn + 500;
  live abort mid-request -> SIGTERM + response closed.
- orchestrator divergentDocmost -> WARN + flag surfaced in status (+ clean case).
- pollTick re-entrancy guard skips an overlapping tick.
- datasource NotFound early-throws (getPageJson/move/rename) + updatedAt:undefined
  stale-read branch (importPageMarkdown/createPage).

Suggestions:
- space.repo updateGitSyncSettings: parameterize the jsonb key (`${prefKey}::text`)
  instead of sql.raw (latent-injection footgun); value stays sql.lit. Spec updated.
- pollTick re-entrancy guard (private `polling` flag).
- page-change.listener docstring: honest about the move/rename/delete over-skip
  (loop-guard keys only on lastUpdatedSource) -> ~poll-interval latency, not loss.
- AGENTS.md: document the root /git smart-HTTP route + GitSyncModule.
- Remove redundant redteam-provenance.spec.ts (covered e2e in
  persistence.extension.spec.ts:145).
- Extract the duplicated SIGTERM->SIGKILL+finish block (watchdog + abort) into
  terminateChild; centralize watchdog-timer teardown in done().

Architecture (deferred, documented): mcp schema header now carries the three-copy
keep-in-sync + schema-core note; the editor-ext contract test documents that the
mcp copy and attribute-behaviour drift (details `open`) are not mechanically
covered yet.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

apps/server/src/integrations/git-sync/services/git-sync.orchestrator.ts

@@ -384,28 +384,45 @@ export class GitSyncOrchestrator implements OnModuleInit, OnModuleDestroy {
     }
   }
 
+  /** True while a pollTick pass is in flight (re-entrancy guard). */
+  private polling = false;
+
   /**
    * One poll tick: catches events missed by the listener and reconciles after
    * downtime. Gated on GIT_SYNC_ENABLED (defensive — the interval is only
    * registered when enabled). Each enabled space runs under its own lock
    * (overlaps skipped). Never throws (runOnce swallows per-space errors).
+   *
+   * Re-entrancy guard: a batch of cycles can take LONGER than the poll interval
+   * (many spaces, slow pushes), so the next interval tick could fire while this
+   * pass is still running. The per-space lock already prevents overlapping cycles
+   * for one space, but an overlapping tick still re-runs enabledSpaces() and
+   * redundant per-space lock attempts for every space. The `polling` flag skips a
+   * tick while one is already in flight; it is in-process only (each replica
+   * guards its own ticks — cross-replica overlap is handled by the Redis lock).
    */
   private async pollTick(): Promise<void> {
     if (!this.environmentService.isGitSyncEnabled()) return;
-    let spaces: EnabledSpace[];
+    if (this.polling) return;
+    this.polling = true;
     try {
-      spaces = await this.enabledSpaces();
-    } catch (err) {
-      this.logger.error(
-        `git-sync: failed to enumerate enabled spaces: ${
-          err instanceof Error ? err.message : String(err)
-        }`,
-      );
-      return;
-    }
-    for (const { spaceId, workspaceId } of spaces) {
-      // runOnce never throws; a per-space error is logged and returned in status.
-      await this.runOnce(spaceId, workspaceId);
+      let spaces: EnabledSpace[];
+      try {
+        spaces = await this.enabledSpaces();
+      } catch (err) {
+        this.logger.error(
+          `git-sync: failed to enumerate enabled spaces: ${
+            err instanceof Error ? err.message : String(err)
+          }`,
+        );
+        return;
+      }
+      for (const { spaceId, workspaceId } of spaces) {
+        // runOnce never throws; a per-space error is logged and returned in status.
+        await this.runOnce(spaceId, workspaceId);
+      }
+    } finally {
+      this.polling = false;
     }
   }
 }