fix(sync): authenticate doc fetches and back off on rate limits

[SPIKESPIGEL404]

Problem

The docs build (pnpm build → prebuild → sync-docs.mjs) fails intermittently with:

sync-docs: fetching bitrouter/bitrouter@main:docs via GitHub
Error: raw 429 for docs/concepts/mcp.zh.md

Two compounding causes:

1. No auth in CI — ci.yml runs pnpm build with no GITHUB_TOKEN in env, so every fetch is unauthenticated.
2. Fragile transport — the script pulls each doc file individually from raw.githubusercontent.com, whose rate limit is per-IP and trips fast on shared Actions runners. Unauthenticated × N raw requests → 429.

This is pre-existing fragility; the recent get-started restructure merge (more files + a docs-changed dispatch) just made it trip reliably.

Fix

• Read blobs via the authenticated git blob API (n.url from the tree response) with Accept: application/vnd.github.raw, instead of raw.githubusercontent.com. The API honors GITHUB_TOKEN for a 5000/hr budget and isn't subject to raw's per-IP throttle.
• Add ghFetch() with backoff on 429 (and 403 with the rate-limit budget exhausted), honoring Retry-After / X-RateLimit-Reset. Applied to both the tree call and each blob read.
• Pass GITHUB_TOKEN to pnpm build in CI. The automatic secrets.GITHUB_TOKEN can read the public bitrouter repo; sync-changelog.mjs (which also fetches) benefits too.

Verification

Ran the rewritten sync-docs.mjs against bitrouter@main with a token:

sync-docs: wrote 111 file(s) into content/docs

Exit 0, no 429s. (It also emits the usual non-blocking "N stale translation(s)" warning, unchanged behavior.)

🤖 Generated with Claude Code