GitCafeCredentials resolves a token the way GitHubCredentials does for gh:
CAFE_TOKEN for the host cafe targets, otherwise cafe's own Git credential
helper, cached and dropped on a 401. REST calls and private attachment
downloads now go over HTTP instead of spawning `cafe api`.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>