feat(web,ui): per-provider git forge API base URL and detection URLs

Configure a default API base URL per git provider (github/gitlab/gitea)
in settings.json gitProviders, with GitHub Enterprise support (Octokit
baseUrl + device-flow web origin derived from the API base), and replace
the client-side custom-domains list with server-persisted detection URL
chips (SSH/HTTPS forms normalized to hosts). The configured API base host
auto-counts as a detection host. Settings round-trip through the existing
/api/config/settings sanitizer; the UI store hydrates from server settings
with a one-time localStorage migration.

packages/vscode/src/bridge-settings-runtime.ts

@@ -234,6 +234,42 @@ const stripDerived = (source: Record<string, unknown>): Record<string, unknown>
   return next;
 };
 
+const GIT_PROVIDER_KEYS = ['github', 'gitlab', 'gitea'];
+
+// Light shape check for the `gitProviders` settings section coming from the
+// webview: reject non-objects outright, coerce detectUrls to a string array and
+// apiBaseUrl to a trimmed string, and drop empty provider entries. Keeps a
+// malformed payload from landing on disk (the shared settings file).
+const sanitizeGitProviders = (input: unknown): Record<string, unknown> | undefined => {
+  if (!input || typeof input !== 'object' || Array.isArray(input)) {
+    return undefined;
+  }
+  const source = input as Record<string, unknown>;
+  const result: Record<string, unknown> = {};
+  for (const key of GIT_PROVIDER_KEYS) {
+    const entry = source[key];
+    if (!entry || typeof entry !== 'object' || Array.isArray(entry)) {
+      continue;
+    }
+    const record = entry as Record<string, unknown>;
+    const apiBaseUrl = typeof record.apiBaseUrl === 'string' ? record.apiBaseUrl.trim() : '';
+    const detectUrls = Array.isArray(record.detectUrls)
+      ? record.detectUrls.filter((value): value is string => typeof value === 'string')
+      : [];
+    const provider: Record<string, unknown> = {};
+    if (apiBaseUrl) {
+      provider.apiBaseUrl = apiBaseUrl;
+    }
+    if (detectUrls.length > 0) {
+      provider.detectUrls = detectUrls;
+    }
+    if (Object.keys(provider).length > 0) {
+      result[key] = provider;
+    }
+  }
+  return Object.keys(result).length > 0 ? result : undefined;
+};
+
 let eagerMigrationAttempted = false;
 
 // Read the merged persisted settings: shared file is canonical (synced with
@@ -326,6 +362,15 @@ export const persistSettings = async (changes: Record<string, unknown>, ctx?: Br
     }
   }
 
+  if ('gitProviders' in restChanges) {
+    const gitProviders = sanitizeGitProviders(restChanges.gitProviders);
+    if (gitProviders) {
+      restChanges.gitProviders = gitProviders;
+    } else {
+      delete restChanges.gitProviders;
+    }
+  }
+
   if (typeof restChanges.opencodeBinary === 'string') {
     restChanges.opencodeBinary = restChanges.opencodeBinary.trim();
   }