Approve the token permissions and confirm the target dates

S01, standing in for S05 (ADR-0002), approves the minimum Gitea and GitHub
token permissions, recorded with the evidence from the Gitea source and the
GitHub documentation; they are still not tested with a minimal token on the
instance. Confirm the target dates of MIL-001 to MIL-006 and PP-001 (RC-026
to RC-032), update TM-001 and regenerate the Credentials wiki page with its
translations.

Task: MIL-002#4

wiki/Credentials.da.md

@@ -1,4 +1,4 @@
-<!-- translation of Credentials.md, source sha256 2660f2095b78 -->
+<!-- translation of Credentials.md, source sha256 10a051e910de -->
 
 > Dette er en oversættelse af [`Credentials`](Credentials). Den engelske side er autoritativ, og ændringer her bliver overskrevet, næste gang wikien publiceres.
 
@@ -15,12 +15,12 @@ Synkroniseringsworkflowet bruger to secrets. Giv hver af dem de mindste rettighe
 
 ## Mindste rettigheder
 
-Disse kommer fra dokumentationen til Gitea og GitHub og fra de API-kald, workflowet foretager. De er **endnu ikke bekræftet med et minimalt token på denne instans**; S05 bør bekræfte dem, når tokens oprettes.
+Disse blev kontrolleret den 2026-10-10 mod Gitea-kildekoden (rutedefinitionerne i `routers/api/v1/api.go`, `main`-grenen) og GitHub-siden "Permissions required for fine-grained personal access tokens" for hvert API-kald, workflows foretager. S01 godkendte dem som stedfortræder for S05 (ADR-0002) den 2026-10-10. De er **ikke afprøvet på denne instans med et token, der kun har disse rettigheder**; kontrollerne i slutningen af dette afsnit er måden at gøre det på.
 
 **Gitea-token** (et personal access token for en bruger, ikke en deploy key; deploy keys virker ikke til REST API'et):
 
-- scope `read:repository`
-- brugeren skal have lov til at læse repositoryets push-spejle, hvilket Gitea begrænser til repository-administratorer
+- scope `read:repository`: hver `/repos/...`-rute kræver repository-scopet, og kaldene nedenfor læser kun
+- brugeren skal være administrator af repositoryet: `push_mirrors`-rutene kræver repository-administration ud over token-scopet
 
 Kald, der foretages: `GET /repos/{owner}/{repo}` og `GET /repos/{owner}/{repo}/push_mirrors`.
 
@@ -28,11 +28,19 @@ Kald, der foretages: `GET /repos/{owner}/{repo}` og `GET /repos/{owner}/{repo}/p
 
 - Resource owner: ejeren af spejl-repositoryet
 - Repository access: kun spejl-repositoryet
-- Repository permission: **Administration: Read and write** (ingen andre tilladelser)
+- Repository permission: **Administration: Read and write** (ingen andre tilladelser); den kræves til `PATCH /repos/{owner}/{repo}` og `PUT /repos/{owner}/{repo}/topics`. `Metadata: Read` tilføjes automatisk og dækker `GET /repos/{owner}/{repo}`.
 - Angiv en udløbsdato
 
 Kald, der foretages: `GET /repos/{owner}/{repo}`, `PATCH /repos/{owner}/{repo}` (beskrivelse) og `PUT /repos/{owner}/{repo}/topics`.
 
+**Gitea-token til wikien** (se "Secret til publicering af wiki" nedenfor): scope `write:repository`, fordi skrivning af en side (`POST`, `PATCH`, `DELETE` under `/repos/{owner}/{repo}/wiki`) kræver repository-scopet med skriveadgang, og brugeren skal have skriveadgang til repositoryets wiki. Oplistning og læsning af sider kræver kun læse-scopet.
+
+**Afprøvning af rettighederne på instansen (valgfrit)**
+
+1. I brugerens Gitea-indstillinger viser det token, der er gemt som `TOKEN_FOR_GITEA`, kun `read:repository`, brugeren er administrator af repositoryet, og en kørsel slutter stadig med `Preflight passed`.
+2. GitHub-tokenet viser kun spejl-repositoryet og `Administration: Read and write` (plus den automatiske `Metadata: Read`), og en kørsel slutter med `Preflight passed` og `Synced description and topics`.
+3. Et midlertidigt token, der mangler én af disse rettigheder, får kørslen til at fejle med `[permissions]` (eller HTTP 403 for Gitea) og navngive kategorien uden at udskrive tokenet.
+
 Format for `PAT_FOR_GITHUB`: kun token-strengen (fx `github_pat_...`) som almindelig tekst. Workflowet tjekker kun, at den ikke er tom; GitHub afviser en forkert værdi (HTTP 401).
 
 ## Hvad workflowet kontrollerer, før det ændrer noget

wiki/Credentials.md

@@ -17,16 +17,21 @@ leaves.
 
 ## Minimum permissions
 
-These come from the Gitea and GitHub documentation and the API calls the
-workflow makes. They have **not been confirmed with a minimal token on this
-instance yet**; S05 should confirm them when the tokens are created.
+These were checked on 2026-10-10 against the Gitea source (the route
+definitions in `routers/api/v1/api.go`, `main` branch) and the GitHub page
+"Permissions required for fine-grained personal access tokens", for every API
+call the workflows make. S01, standing in for S05 (ADR-0002), approved them on
+2026-10-10. They have **not been tested on this instance with a token that
+holds only these permissions**; the checks at the end of this section are the
+way to do that.
 
 **Gitea token** (a personal access token of a user, not a deploy key; deploy
 keys do not work for the REST API):
 
-- scope `read:repository`
-- the user must be allowed to read the repository's push mirrors, which
-  Gitea limits to repository administrators
+- scope `read:repository`: every `/repos/...` route needs the repository
+  scope, and the calls below only read
+- the user must be an administrator of the repository: the `push_mirrors`
+  routes require repository administration in addition to the token scope
 
 Calls made: `GET /repos/{owner}/{repo}` and `GET /repos/{owner}/{repo}/push_mirrors`.
 
@@ -34,12 +39,33 @@ Calls made: `GET /repos/{owner}/{repo}` and `GET /repos/{owner}/{repo}/push_mirr
 
 - Resource owner: the owner of the mirror repository
 - Repository access: only the mirror repository
-- Repository permission: **Administration: Read and write** (no other permission)
+- Repository permission: **Administration: Read and write** (no other
+  permission); it is needed for `PATCH /repos/{owner}/{repo}` and
+  `PUT /repos/{owner}/{repo}/topics`. `Metadata: Read` is added automatically
+  and covers `GET /repos/{owner}/{repo}`.
 - Set an expiry date
 
 Calls made: `GET /repos/{owner}/{repo}`, `PATCH /repos/{owner}/{repo}` (description)
 and `PUT /repos/{owner}/{repo}/topics`.
 
+**Gitea token for the wiki** (see "Wiki publishing secret" below): scope
+`write:repository`, because writing a page (`POST`, `PATCH`, `DELETE` under
+`/repos/{owner}/{repo}/wiki`) needs the repository scope with write access, and
+the user needs write access to the repository's wiki. Listing and reading
+pages needs only the read scope.
+
+**Testing the permissions on the instance (optional)**
+
+1. In the Gitea settings of the user, the token stored as `TOKEN_FOR_GITEA`
+   lists only `read:repository`, the user is an administrator of the
+   repository, and a run still ends with `Preflight passed`.
+2. The GitHub token lists only the mirror repository and
+   `Administration: Read and write` (plus the automatic `Metadata: Read`), and
+   a run ends with `Preflight passed` and `Synced description and topics`.
+3. A throwaway token that lacks one of these permissions makes the run fail
+   with `[permissions]` (or HTTP 403 for Gitea) and names the category,
+   without printing the token.
+
 Format of `PAT_FOR_GITHUB`: only the token string (for example
 `github_pat_...`), as clear text. The workflow only checks that it is not empty;
 GitHub rejects a wrong value (HTTP 401).

wiki/Credentials.ms.md

@@ -1,4 +1,4 @@
-<!-- translation of Credentials.md, source sha256 2660f2095b78 -->
+<!-- translation of Credentials.md, source sha256 10a051e910de -->
 
 > Ini ialah terjemahan [`Credentials`](Credentials). Halaman bahasa Inggeris ialah teks yang sah, dan perubahan di sini akan ditimpa pada penerbitan wiki yang seterusnya.
 
@@ -15,12 +15,12 @@ Aliran kerja penyegerakan menggunakan dua rahsia (secret). Beri setiap satu keis
 
 ## Kebenaran minimum
 
-Ini datang daripada dokumentasi Gitea dan GitHub serta panggilan API yang dibuat oleh aliran kerja. Ia **belum disahkan dengan token minimum pada instans ini**; S05 harus mengesahkannya apabila token dicipta.
+Ini disemak pada 2026-10-10 terhadap kod sumber Gitea (definisi laluan dalam `routers/api/v1/api.go`, cabang `main`) dan halaman GitHub "Permissions required for fine-grained personal access tokens", bagi setiap panggilan API yang dibuat oleh aliran kerja. S01 meluluskannya sebagai pengganti S05 (ADR-0002) pada 2026-10-10. Ia **belum diuji pada instans ini dengan token yang hanya mempunyai kebenaran ini**; semakan di hujung bahagian ini ialah cara untuk melakukannya.
 
 **Token Gitea** (personal access token seorang pengguna, bukan deploy key; deploy key tidak berfungsi untuk REST API):
 
-- skop `read:repository`
-- pengguna mesti dibenarkan membaca push mirror repositori, yang dihadkan oleh Gitea kepada pentadbir repositori
+- skop `read:repository`: setiap laluan `/repos/...` memerlukan skop repositori, dan panggilan di bawah hanya membaca
+- pengguna mesti pentadbir repositori: laluan `push_mirrors` memerlukan pentadbiran repositori selain skop token
 
 Panggilan yang dibuat: `GET /repos/{owner}/{repo}` dan `GET /repos/{owner}/{repo}/push_mirrors`.
 
@@ -28,11 +28,19 @@ Panggilan yang dibuat: `GET /repos/{owner}/{repo}` dan `GET /repos/{owner}/{repo
 
 - Resource owner: pemilik repositori cermin
 - Repository access: hanya repositori cermin
-- Repository permission: **Administration: Read and write** (tiada kebenaran lain)
+- Repository permission: **Administration: Read and write** (tiada kebenaran lain); ia diperlukan untuk `PATCH /repos/{owner}/{repo}` dan `PUT /repos/{owner}/{repo}/topics`. `Metadata: Read` ditambah secara automatik dan meliputi `GET /repos/{owner}/{repo}`.
 - Tetapkan tarikh tamat tempoh
 
 Panggilan yang dibuat: `GET /repos/{owner}/{repo}`, `PATCH /repos/{owner}/{repo}` (penerangan) dan `PUT /repos/{owner}/{repo}/topics`.
 
+**Token Gitea untuk wiki** (lihat "Secret untuk menerbitkan wiki" di bawah): skop `write:repository`, kerana menulis halaman (`POST`, `PATCH`, `DELETE` di bawah `/repos/{owner}/{repo}/wiki`) memerlukan skop repositori dengan akses tulis, dan pengguna mesti mempunyai akses tulis kepada wiki repositori. Menyenaraikan dan membaca halaman hanya memerlukan skop baca.
+
+**Menguji kebenaran pada instans (pilihan)**
+
+1. Dalam tetapan Gitea pengguna, token yang disimpan sebagai `TOKEN_FOR_GITEA` hanya menyenaraikan `read:repository`, pengguna ialah pentadbir repositori, dan larian masih berakhir dengan `Preflight passed`.
+2. Token GitHub hanya menyenaraikan repositori cermin dan `Administration: Read and write` (serta `Metadata: Read` automatik), dan larian berakhir dengan `Preflight passed` dan `Synced description and topics`.
+3. Token sementara yang tidak mempunyai salah satu kebenaran ini menyebabkan larian gagal dengan `[permissions]` (atau HTTP 403 bagi Gitea) dan menamakan kategori tanpa mencetak token.
+
 Format `PAT_FOR_GITHUB`: hanya rentetan token (contohnya `github_pat_...`) sebagai teks biasa. Aliran kerja hanya menyemak bahawa ia tidak kosong; GitHub menolak nilai yang salah (HTTP 401).
 
 ## Perkara yang disemak oleh aliran kerja sebelum mengubah apa-apa