fix: harden phase auth and failure handling

phase8_cutover.sh

@@ -369,6 +369,7 @@ fi
 log_step 11 "Marking GitHub repos as offsite backup..."
 
 init_phase8_state_store
+GITHUB_REPO_UPDATE_FAILURES=0
 for repo in "${REPOS[@]}"; do
   # Fetch repo metadata (single API call)
   REPO_DATA=$(github_api GET "/repos/${GITHUB_USERNAME}/${repo}" 2>/dev/null || echo "{}")
@@ -403,6 +404,7 @@ for repo in "${REPOS[@]}"; do
     log_success "Marked GitHub repo as mirror: ${repo}"
   else
     log_error "Failed to update GitHub repo: ${repo}"
+    GITHUB_REPO_UPDATE_FAILURES=$((GITHUB_REPO_UPDATE_FAILURES + 1))
   fi
 
   # Disable GitHub Pages if enabled (Pages can incur bandwidth costs)
@@ -413,5 +415,9 @@ done
 # Summary
 # ---------------------------------------------------------------------------
 printf '\n'
+if [[ "$GITHUB_REPO_UPDATE_FAILURES" -gt 0 ]]; then
+  log_error "Phase 8 failed: ${GITHUB_REPO_UPDATE_FAILURES} GitHub repo update(s) failed"
+  exit 1
+fi
 log_success "Phase 8 complete — Gitea is live at https://${GITEA_DOMAIN}"
 log_info "GitHub repos marked as offsite backup. Push mirrors remain active."