Case sync: refresh remote URL with current token before each push

Cases failed to push silently after the Gitea token in Infisical was
rotated: the embedded credential in each case repo's origin URL was
the old token, the rotation never propagated, and capture_output=True
hid the auth failure as a logger.warning. Three cases (1033-25,
1130-25, 1194-25) accumulated unpushed commits over weeks before
this was noticed.

Fixes the root cause in two places: web/gitea_client.py for uploads
through the FastAPI endpoint, and mcp-server/services/git_sync.py
for case_update / document_upload through MCP tools (which previously
committed but never pushed at all).

The new commit_and_push helper:
- re-injects the current GITEA_ACCESS_TOKEN into the existing origin
  URL on every call, so pushes survive token rotation
- logs push failures at WARNING with the actual stderr (the previous
  code suppressed errors entirely)
- continues to push even when the commit was a no-op, in case earlier
  commits are still unpushed

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

mcp-server/src/legal_mcp/tools/cases.py

@@ -13,7 +13,7 @@ from uuid import UUID
 import httpx
 
 from legal_mcp import config
-from legal_mcp.services import audit, db, practice_area as pa
+from legal_mcp.services import audit, db, git_sync, practice_area as pa
 
 logger = logging.getLogger(__name__)
 
@@ -315,21 +315,13 @@ async def case_update(
 
     updated = await db.update_case(UUID(case["id"]), **fields)
 
-    # Git commit the update (best-effort)
+    # Git commit + push the update (best-effort)
     try:
         case_dir = config.find_case_dir(case_number)
         if case_dir.exists():
             case_json = case_dir / "case.json"
             case_json.write_text(json.dumps(updated, default=str, ensure_ascii=False, indent=2))
-            subprocess.run(["git", "add", "case.json"], cwd=case_dir, capture_output=True)
-            subprocess.run(
-                ["git", "commit", "-m", f"עדכון תיק: {', '.join(fields.keys())}"],
-                cwd=case_dir,
-                capture_output=True,
-                env={"GIT_AUTHOR_NAME": "Ezer Mishpati", "GIT_AUTHOR_EMAIL": "legal@local",
-                     "GIT_COMMITTER_NAME": "Ezer Mishpati", "GIT_COMMITTER_EMAIL": "legal@local",
-                     "PATH": "/usr/bin:/bin"},
-            )
+            git_sync.commit_and_push(case_dir, f"עדכון תיק: {', '.join(fields.keys())}")
     except Exception:
         pass  # git not available — non-critical