Track invalid Git credentials in read-only draft template visibility

[ChristianLempa]

Summary

Draft templates from Git-synced libraries are currently hidden when the library is statically read-only, e.g. push changes are disabled or required repository auth/author configuration is missing.

However, if credentials are present but invalid, the library may still look push-capable until a clone/push/sync operation fails. We should track verified credential health and use it in draft visibility/read-only decisions.

Current behavior

• Missing auth or author identity => read-only => draft templates hidden.
• Wrong token/SSH key with fields populated => may still be treated as configured.
• The failure is only discovered during Git operations such as library sync or template push-back.

Desired behavior

• Persist or derive a clear credential/auth health state after Git failures.
• Treat verified bad credentials as not push-capable until credentials are updated or a later verification succeeds.
• Ensure draft templates from such libraries remain hidden while the library is effectively read-only.

Notes

Potential implementation options:

• Add repository/library auth verification status fields.
• Classify Git clone/push errors that indicate authentication/authorization failures.
• Recompute read-only template visibility from verified push capability, not only from credential presence.
• Add tests with a mocked Git clone/push failure or local fake Git transport to avoid relying on external GitHub/GitLab state.

Affected version: observed during 0.3.0b1.dev0 development.