feat: pr approve/reject, repo migrate/template, secret stdin fix, docs

- fgj pr approve / pr reject: thin shortcuts over 'pr review --approve'
  and '--request-changes'. Reject requires a body.
- fgj repo migrate: wrap SDK MigrateRepo. Supports git, github, gitlab,
  gitea, gogs services; mirror mode with --mirror-interval; selective
  import (wiki/labels/milestones/issues/PRs/releases/LFS); auth via
  --auth-token or --auth-username/--auth-password. Defaults owner to
  the authenticated user.
- fgj repo create-from-template: wrap SDK CreateRepoFromTemplate with
  fine-grained --with-{content,topics,labels,webhooks,git-hooks,avatar}
  flags. Template is owner/name; new repo defaults to the current user.
- Rework 'fgj actions secret create' input. New cmd/secret_input.go
  resolves values from --body, --body-file (path or '-'), hidden TTY
  prompt via term.ReadPassword, or piped stdin. Trims trailing
  whitespace, rejects empty values. Replaces fmt.Scanln which broke on
  spaces/newlines and echoed input.
- CHANGELOG: v0.4.0 Unreleased section documenting all additions,
  changes, and development items.
- README: updated feature list with new commands.

cmd/repo_migrate.go

@@ -0,0 +1,170 @@
+package cmd
+
+import (
+	"fmt"
+	"strings"
+
+	"code.gitea.io/sdk/gitea"
+	"github.com/spf13/cobra"
+)
+
+var repoMigrateCmd = &cobra.Command{
+	Use:     "migrate <clone-url>",
+	Aliases: []string{"m"},
+	Short:   "Migrate a repository from an external service",
+	Long: `Import a repository from GitHub, GitLab, Gogs, Gitea, or a plain Git
+remote. By default the migration is a one-shot import; pass --mirror
+to keep syncing on an interval.
+
+Authentication for the source repo is passed via --auth-token or
+--auth-username + --auth-password. Neither is stored after the
+migration completes on the server side.`,
+	Example: `  # Migrate a GitHub repo to this user's account
+  fgj repo migrate https://github.com/cli/cli \
+    --name gh-mirror --service github --auth-token "$GH_TOKEN"
+
+  # Mirror a plain Git remote into an org
+  fgj repo migrate https://example.com/project.git \
+    --name project --owner infrastructure --mirror --mirror-interval 8h
+
+  # Migrate with all content kinds
+  fgj repo migrate https://gitea.com/user/repo \
+    --name repo --service gitea --auth-token "$TOKEN" \
+    --wiki --labels --milestones --issues --pulls --releases --lfs`,
+	Args: cobra.ExactArgs(1),
+	RunE: runRepoMigrate,
+}
+
+func init() {
+	repoCmd.AddCommand(repoMigrateCmd)
+
+	repoMigrateCmd.Flags().String("name", "", "Name for the new repository (required)")
+	repoMigrateCmd.Flags().String("owner", "", "Owner (user or org) for the new repository (defaults to you)")
+	repoMigrateCmd.Flags().String("service", "git", "Source service: git, github, gitlab, gitea, gogs")
+	repoMigrateCmd.Flags().StringP("description", "d", "", "Description of the new repository")
+	repoMigrateCmd.Flags().String("auth-token", "", "Auth token for the source repo (preferred over username/password)")
+	repoMigrateCmd.Flags().String("auth-username", "", "Auth username for the source repo")
+	repoMigrateCmd.Flags().String("auth-password", "", "Auth password for the source repo")
+	repoMigrateCmd.Flags().Bool("private", false, "Make the new repository private")
+	repoMigrateCmd.Flags().Bool("mirror", false, "Mirror the source (keep syncing) instead of one-shot import")
+	repoMigrateCmd.Flags().String("mirror-interval", "", "Mirror sync interval (e.g. 8h, 24h); only with --mirror")
+	repoMigrateCmd.Flags().Bool("wiki", false, "Include wiki in the migration")
+	repoMigrateCmd.Flags().Bool("labels", false, "Include labels")
+	repoMigrateCmd.Flags().Bool("milestones", false, "Include milestones")
+	repoMigrateCmd.Flags().Bool("issues", false, "Include issues")
+	repoMigrateCmd.Flags().Bool("pulls", false, "Include pull requests")
+	repoMigrateCmd.Flags().Bool("releases", false, "Include releases")
+	repoMigrateCmd.Flags().Bool("lfs", false, "Include Git LFS content")
+	repoMigrateCmd.Flags().String("lfs-endpoint", "", "Explicit Git LFS server URL")
+
+	_ = repoMigrateCmd.MarkFlagRequired("name")
+	addJSONFlags(repoMigrateCmd, "Output created repository as JSON")
+}
+
+func runRepoMigrate(cmd *cobra.Command, args []string) error {
+	cloneURL := args[0]
+
+	repoName, _ := cmd.Flags().GetString("name")
+	if strings.TrimSpace(repoName) == "" {
+		return fmt.Errorf("--name is required")
+	}
+
+	owner, _ := cmd.Flags().GetString("owner")
+	serviceStr, _ := cmd.Flags().GetString("service")
+
+	service, err := parseGitService(serviceStr)
+	if err != nil {
+		return err
+	}
+
+	client, err := loadClient()
+	if err != nil {
+		return err
+	}
+
+	// Default owner = authenticated user.
+	if owner == "" {
+		user, _, err := client.GetMyUserInfo()
+		if err != nil {
+			return fmt.Errorf("failed to resolve current user (pass --owner to override): %w", err)
+		}
+		owner = user.UserName
+	}
+
+	description, _ := cmd.Flags().GetString("description")
+	authToken, _ := cmd.Flags().GetString("auth-token")
+	authUser, _ := cmd.Flags().GetString("auth-username")
+	authPass, _ := cmd.Flags().GetString("auth-password")
+	private, _ := cmd.Flags().GetBool("private")
+	mirror, _ := cmd.Flags().GetBool("mirror")
+	mirrorInterval, _ := cmd.Flags().GetString("mirror-interval")
+	if mirrorInterval != "" && !mirror {
+		return fmt.Errorf("--mirror-interval requires --mirror")
+	}
+
+	wiki, _ := cmd.Flags().GetBool("wiki")
+	labels, _ := cmd.Flags().GetBool("labels")
+	milestones, _ := cmd.Flags().GetBool("milestones")
+	issues, _ := cmd.Flags().GetBool("issues")
+	pulls, _ := cmd.Flags().GetBool("pulls")
+	releases, _ := cmd.Flags().GetBool("releases")
+	lfs, _ := cmd.Flags().GetBool("lfs")
+	lfsEndpoint, _ := cmd.Flags().GetString("lfs-endpoint")
+
+	opt := gitea.MigrateRepoOption{
+		RepoName:       repoName,
+		RepoOwner:      owner,
+		CloneAddr:      cloneURL,
+		Service:        service,
+		AuthUsername:   authUser,
+		AuthPassword:   authPass,
+		AuthToken:      authToken,
+		Private:        private,
+		Description:    description,
+		Mirror:         mirror,
+		MirrorInterval: mirrorInterval,
+		Wiki:           wiki,
+		Labels:         labels,
+		Milestones:     milestones,
+		Issues:         issues,
+		PullRequests:   pulls,
+		Releases:       releases,
+		LFS:            lfs,
+		LFSEndpoint:    lfsEndpoint,
+	}
+
+	ios.StartSpinner("Starting migration...")
+	repo, _, err := client.MigrateRepo(opt)
+	ios.StopSpinner()
+	if err != nil {
+		return fmt.Errorf("migration failed: %w", err)
+	}
+
+	if wantJSON(cmd) {
+		return outputJSON(cmd, repo)
+	}
+
+	cs := ios.ColorScheme()
+	fmt.Fprintf(ios.Out, "%s Migrated to %s\n", cs.SuccessIcon(), repo.FullName)
+	if repo.HTMLURL != "" {
+		fmt.Fprintf(ios.Out, "  %s\n", repo.HTMLURL)
+	}
+	return nil
+}
+
+func parseGitService(s string) (gitea.GitServiceType, error) {
+	switch strings.ToLower(s) {
+	case "", "git", "plain":
+		return gitea.GitServicePlain, nil
+	case "github":
+		return gitea.GitServiceGithub, nil
+	case "gitlab":
+		return gitea.GitServiceGitlab, nil
+	case "gitea", "forgejo":
+		return gitea.GitServiceGitea, nil
+	case "gogs":
+		return gitea.GitServiceGogs, nil
+	default:
+		return "", fmt.Errorf("unknown --service %q (expected: git, github, gitlab, gitea, gogs)", s)
+	}
+}