fix(api): prefer anonymous gitea weekly stats

apps/api/tests/test_report_generation_service.py

@@ -151,7 +151,8 @@ class TestWeeklyReportGitStats:
 
         def fake_urlopen(request, timeout):
             assert "/api/v1/repos/wooo/awoooi/commits?" in request.full_url
-            assert timeout == 3
+            assert timeout == 2
+            assert "Authorization" not in request.headers
             return Response()
 
         monkeypatch.setattr(weekly_report_module, "urlopen", fake_urlopen)
@@ -167,6 +168,41 @@ class TestWeeklyReportGitStats:
         assert deploys == 2
         assert source_ok is True
 
+    def test_gitea_commit_stats_prefers_anonymous_read_before_token(self, monkeypatch):
+        payload = [{"commit": {"message": "fix(api): one\n"}}]
+        seen_authorization = []
+
+        class Response:
+            headers = {"X-Total-Count": "1"}
+
+            def __enter__(self):
+                return self
+
+            def __exit__(self, *_args):
+                return None
+
+            def read(self):
+                return weekly_report_module.json.dumps(payload).encode("utf-8")
+
+        def fake_urlopen(request, timeout):
+            seen_authorization.append(request.headers.get("Authorization"))
+            return Response()
+
+        monkeypatch.setattr(weekly_report_module, "urlopen", fake_urlopen)
+        monkeypatch.setattr(weekly_report_module.settings, "GITEA_API_URL", "https://gitea.example.test")
+        monkeypatch.setattr(weekly_report_module.settings, "GITEA_REPO_OWNER", "wooo")
+        monkeypatch.setattr(weekly_report_module.settings, "GITEA_REPO_NAME", "awoooi")
+        monkeypatch.setattr(weekly_report_module.settings, "GITEA_API_TOKEN", "redacted-token")
+
+        svc = WeeklyReportService(stats_service=object(), k3s_monitor=object())
+        monkeypatch.setattr(svc, "_gitea_api_candidates", lambda: ["https://gitea.example.test"])
+        commits, deploys, source_ok = svc._get_gitea_commit_stats(datetime.now(_TZ_TAIPEI))
+
+        assert commits == 1
+        assert deploys == 0
+        assert source_ok is True
+        assert seen_authorization == [None]
+
     def test_gitea_commit_stats_uses_total_header_with_limited_scan(self, monkeypatch):
         payload = [{"commit": {"message": "fix(api): one\n"}} for _ in range(50)]
         calls = []