chore: initialize Gitea v1.27.2 fork

Includes direct password setup links in registration emails.

Assisted-by: Codex:GPT-5

modules/private/internal_test.go

@@ -0,0 +1,37 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package private
+
+import (
+	"testing"
+
+	"gitea.dev/modules/setting"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestInternalAPIConnectionIsLocal(t *testing.T) {
+	cases := []struct {
+		name     string
+		protocol setting.Scheme
+		localURL string
+		want     bool
+	}{
+		// HTTPUnix always dials the unix socket (a local target), whatever LOCAL_ROOT_URL says
+		{"unix socket", setting.HTTPUnix, "https://gitea.example.com/", true},
+		{"localhost", setting.HTTP, "http://localhost:3000/", true},
+		{"loopback ipv4", setting.HTTPS, "https://127.0.0.1:3000/", true},
+		{"loopback ipv6", setting.HTTPS, "https://[::1]:3000/", true},
+		// a non-loopback LOCAL_ROOT_URL is a real network hop and must be verified
+		{"remote host", setting.HTTPS, "https://gitea.internal:443/", false},
+		{"remote ip", setting.HTTPS, "https://10.0.0.5:3000/", false},
+		// an unparseable LOCAL_ROOT_URL is a hard misconfiguration; fail closed to verification
+		{"invalid url", setting.HTTPS, "://bad", false},
+	}
+	for _, c := range cases {
+		t.Run(c.name, func(t *testing.T) {
+			assert.Equal(t, c.want, internalAPIConnectionIsLocal(c.protocol, c.localURL))
+		})
+	}
+}