Support authenticated skill imports (private sources + rate limits)

[Ronen-Levy]

Skill imports fetch from remote sources (e.g. GitHub) without authentication. This causes two failures:

• Rate limiting — unauthenticated GitHub API calls are capped at 60 requests/hour. Recursive and batch imports exhaust this quickly and fail with 403 rate limit exceeded.
• Private/restricted sources — any source that requires auth (private repos, internal skill backends) can't be imported at all.

There is currently no way for an operator to supply credentials for a skill source.

Motivation

• Make it possible to import from private repositories and authenticated third-party skill backends.
• Avoid hitting rate limits on large/batch imports.
• Support deployments that import from multiple different providers, each with its own credentials.
• Allow operators to avoid storing long-lived tokens where they prefer interactive login instead.

Desired outcome

A way to configure authentication per source/endpoint, so that when the store fetches a URL during an import, the right credential is applied. It should be provider-agnostic — not tied to GitHub — assuming only that the source accepts a standard API token.

The configuration should let an operator choose, per endpoint, between:

• supplying a token/key directly, and
• requiring an interactive login (the user authenticates with the provider and supplies the resulting token at import time, rather than a token being stored).

When a source needs authentication and none is available, the import should fail with a clear, actionable message telling the user how to authenticate — not an opaque error.

Acceptance criteria

• An operator can configure credentials for a specific skill source/endpoint.
• Imports from a configured private/authenticated source succeed.
• Large/batch imports no longer fail due to unauthenticated rate limits.
• The mechanism is not GitHub-specific (works for other token-accepting providers).
• An operator can opt for interactive login instead of a stored token for a given source.
• When auth is required but missing, the import returns a clear message indicating how to authenticate.
• Sources that need no auth continue to work unchanged (no regression for public imports).

[github-actions]

🤖 Automatic Labeling

Bob Shell has analyzed this issue and applied the following label(s): enhancement, security

These labels were selected based on the issue content and available label descriptions. If you believe the labels are incorrect, feel free to modify them manually.