Harden Gitea write requests against dropped Content-Type

Runs from the GitHub runner were failing every migrate with 422
"[]: Empty Content-Type" while the same script worked from a local
network, so the header is being dropped in front of Gitea on the
public path rather than the payload being wrong.

- route POST/PATCH through one gitea_write helper: body via
  --data-binary @file (also keeps the PAT out of the process list),
  Expect: disabled, explicit charset, retry over HTTP/1.1 when the
  response still reports an empty Content-Type
- add DEBUG_HTTP=1 to dump request/response headers, tokens redacted
- move temp files into a mktemp -d cleaned by trap
- add a workflow preflight that POSTs JSON over HTTP/2 and HTTP/1.1 to
  show whether the header survives the trip
- drop the redundant chmod; the script is committed mode 100755

.github/workflows/mirror-to-gitea.yml

@@ -4,7 +4,12 @@ on:
   schedule:
     # Runs at 00:00 UTC daily. Adjust if you want midnight EAT (UTC+3) instead — see note below.
     - cron: "0 0 * * *"
-  workflow_dispatch: {} # allows manual trigger from the Actions tab too
+  workflow_dispatch:
+    inputs:
+      debug_http:
+        description: "Print request/response headers for every Gitea write call"
+        type: boolean
+        default: false
 
 jobs:
   mirror:
@@ -16,12 +21,35 @@ jobs:
       - name: Install jq
         run: sudo apt-get update && sudo apt-get install -y jq
 
+      # The mirror runs from a GitHub runner, not from the network the script is
+      # usually tested on, so it can reach Gitea through a different proxy path.
+      # This POSTs a harmless JSON body and reports whether Content-Type survived
+      # the trip — a 422 "Empty Content-Type" here means the header is being
+      # dropped in front of Gitea, not that the mirror payload is wrong.
+      - name: Preflight - can this runner POST JSON to Gitea?
+        env:
+          GITEA_URL: ${{ secrets.GITEA_URL }}
+          GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
+        run: |
+          url="${GITEA_URL%/}"
+          echo "GET /api/v1/version -> $(curl -s -o /dev/null -w '%{http_code}' \
+            -H "Authorization: token ${GITEA_TOKEN}" "${url}/api/v1/version")"
+          for proto in --http2 --http1.1; do
+            code=$(curl -s $proto -o /tmp/pre.json -w '%{http_code}' \
+              -X POST "${url}/api/v1/markdown" \
+              -H "Authorization: token ${GITEA_TOKEN}" \
+              -H "Content-Type: application/json" \
+              -H "Expect:" \
+              --data-binary '{"text":"preflight","mode":"markdown"}')
+            echo "POST /api/v1/markdown ${proto} -> ${code}"
+            [ "$code" = "200" ] || head -c 300 /tmp/pre.json; echo
+          done
+
       - name: Mirror all repos to Gitea
         env:
           GITHUB_TOKEN: ${{ secrets.GH_PAT }}
           GITEA_URL: ${{ secrets.GITEA_URL }}
           GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
           GITEA_OWNER: ${{ secrets.GITEA_OWNER }}
-        run: |
-          chmod +x ./mirror-github-to-gitea.sh
-          ./mirror-github-to-gitea.sh
+          DEBUG_HTTP: ${{ inputs.debug_http && '1' || '' }}
+        run: ./mirror-github-to-gitea.sh