A test pins syncing a mirror whose origin has no stored token: it says to reconnect, in words, and never crashes #7177

credentialFor in src/origins/credential.ts answers no_token when an origin has no sealed secret, and no test names it.

Done:

• [ ] A new test uses the fake origin (test/fake-origin.ts) to mirror a private repository, then removes the origin's sealed secret.
• [ ] Syncing through the API and MCP sync answers a refusal that says to reconnect the origin, not a 500. The mirror's refs are unchanged.
• [ ] The origin's settings page shows the same reconnect line.

Files: test/origin-no-token.test.ts

If the test finds the behaviour wrong, fix the module it names in the same pull and say so. If the check fails in a test this pull does not touch, name it in the pull rather than widening the change.

Before pushing: bun x tsc --noEmit and the new test.