Let pushes go by an HTTPS token or an SSH deploy key

The push credential is either a push-only account's token, handed to git
through a credential helper that names environment variables, never
values, or a deploy key in a short-lived ssh-agent. The remote URL
follows the credential. Configured as gitea.push_user and push_token, or
gitea.push_key.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PPQ14L3LikyefCMFBqEbKE

nisse-dev/tests/test_config.py

@@ -351,3 +351,12 @@ def test_a_bad_build_host_port_is_reported() -> None:
 def test_the_push_key_is_optional_and_a_path() -> None:
     assert build().push_key is None
     assert build(gitea__push_key="~/k").push_key == Path("~/k").expanduser()
+
+
+def test_a_push_token_needs_its_user_and_excludes_a_key() -> None:
+    config = build(gitea__push_user="pusher", gitea__push_token="${TEST_GITEA_TOKEN}")
+    assert (config.push_user, config.push_token) == ("pusher", "gt")
+    with pytest.raises(ConfigError, match="set both or neither"):
+        build(gitea__push_user="pusher")
+    with pytest.raises(ConfigError, match="not both"):
+        build(gitea__push_user="p", gitea__push_token="t", gitea__push_key="~/k")