Cloudflare's free plan limits request bodies to ~100MB, causing 413 on large
docker layer pushes. Push through an SSH tunnel directly to the Gitea origin
server on vps.git instead of through Cloudflare.
1. For docker command, look up the repo owner via 'repo search' API
2. Use 'ego-mgr lookup' to get the owner's agent-id
3. Export AGENT_ID to that agent-id so docker push goes to correct namespace
4. Also fix link API auth: use '-u owner:token' (basic auth) instead of
'Authorization: token' header, since repo owner's 'git' secret is a
password not a bearer token
The link step now:
1. Extracts the actual repo owner from the git remote URL
2. Captures HTTP response status and body
3. Shows a clear warning when the repo belongs to a different owner
(requires site admin or matching owner), instead of silently failing
