clearer git permission errors that match the credential type

src/lib/server/git-error.ts

@@ -0,0 +1,27 @@
+/**
+ * Pure git error-message helpers, split out of git.ts so they can be unit-tested
+ * without importing git.ts's heavy deps (db/docker). No I/O here.
+ */
+
+/**
+ * The permission-denied message, tailored to the auth in use (#1509). A token/password
+ * credential paired with an `git@...` SSH URL is the common trap: git uses the SSH
+ * transport and never applies the token, so it fails with a public-key error - blaming
+ * "SSH credentials" then is actively misleading. Point at the real cause instead.
+ */
+export function permissionDeniedMessage(
+	authType?: string | null,
+	url?: string | null
+): string {
+	const isSshUrl = !!url && url.startsWith('git@');
+	if (authType === 'password') {
+		if (isSshUrl) {
+			return 'Permission denied. This credential uses a token, but the repository URL is an SSH URL (git@...). Use an https:// URL for token authentication.';
+		}
+		return 'Permission denied. Check your access token and that it has repository access.';
+	}
+	if (authType === 'ssh') {
+		return 'Permission denied. Check your SSH key and that it is authorized for this repository.';
+	}
+	return 'Permission denied. Check your credentials.';
+}