Use dedicated read access for private UI CI dependency

Why: Gitea job token can fetch Frontend but receives repository-not-found for private UI.

Evidence: PR CI run 3213 checkout log shows Frontend fetch succeeded and UI fetch failed; Frontend secret listing lacks SUBMODULE_TOKEN.

Impact: CI now requests the dedicated UI read credential and fails clearly until it is provisioned.

Refs: IAM U3 Frontend PR #86

.gitea/workflows/ci.yml

@@ -12,6 +12,7 @@ jobs:
       - name: Check out fixed Frontend and UI commits
         env:
           TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          UI_TOKEN: ${{ secrets.SUBMODULE_TOKEN }}
           UI_SHA: 7c35a78abc8ef7db6fb2d508b2971d59a90de964
         run: |
           set -euo pipefail
@@ -21,6 +22,10 @@ jobs:
           [[ "${GITHUB_SHA}" =~ ^[0-9a-f]{40}$ ]]
           [[ "${UI_SHA}" =~ ^[0-9a-f]{40}$ ]]
           test -n "${TOKEN}"
+          if [ -z "${UI_TOKEN}" ]; then
+            echo "SUBMODULE_TOKEN is required for the private UI dependency" >&2
+            exit 1
+          fi
           export GIT_TERMINAL_PROMPT=0
           mkdir -p "${RUNNER_TEMP}/iam-frontend-ci/frontend" "${RUNNER_TEMP}/iam-frontend-ci/ui"
           cd "${RUNNER_TEMP}/iam-frontend-ci/frontend"
@@ -32,7 +37,7 @@ jobs:
           cd "${RUNNER_TEMP}/iam-frontend-ci/ui"
           git init -q
           git remote add origin "${GITHUB_SERVER_URL}/weichen/Agent-System-UI.git"
-          git -c http.extraheader="AUTHORIZATION: token ${TOKEN}" fetch --depth=1 origin "${UI_SHA}"
+          git -c http.extraheader="AUTHORIZATION: token ${UI_TOKEN}" fetch --depth=1 origin "${UI_SHA}"
           git checkout -q --detach FETCH_HEAD
           test "$(git rev-parse HEAD)" = "${UI_SHA}"
           git -C "${RUNNER_TEMP}/iam-frontend-ci/frontend" status --short