feat: add pragmatic git sync — push project to external git remote

Adds a "Git Sync" section in the Integrations rail panel that lets
project owners configure an HTTPS remote URL (with embedded auth token)
and force-push all project files as a single commit.

Backend:
- GitSyncHandler: assembles project docs + binary files into a temp dir,
  runs git init/commit/push --force, then cleans up
- GitSyncController: GET/POST /project/:id/git-sync (configure),
  POST /project/:id/git-sync/push (trigger)
- Project model: gitRemote field
- Dockerfile: ensures git is present at runtime
- Env flag: OVERLEAF_ENABLE_GIT_SYNC=true (set in k8s manifest)

Frontend:
- GitSyncWidget: URL input + Save + Push Now buttons, success/error feedback
- Integrations panel: shows widget when gitSyncEnabled
- Rail: shows Integrations tab when gitSyncEnabled (was only gitBridgeEnabled)
- i18n: en + fr translations

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

server-ce/Dockerfile

@@ -75,6 +75,10 @@ RUN --mount=type=cache,target=/root/.cache \
     echo "==== PACK LOGS (all attempts failed) ===="; \
     find /tmp -name pack.log -exec cat {} \; 2>/dev/null || true; \
     exit 1
+# Ensure git is available for the git sync feature
+# -------------------------------------------------
+RUN apt-get install -y --no-install-recommends git && rm -rf /var/lib/apt/lists/*
+
 # Copy runit service startup scripts to its location
 # --------------------------------------------------
 ADD server-ce/runit /etc/service

server-ce/config/settings.js

@@ -58,6 +58,8 @@ const settings = {
   allowAnonymousReadAndWriteSharing:
     process.env.OVERLEAF_ALLOW_ANONYMOUS_READ_AND_WRITE_SHARING === 'true',
 
+  enableGitSync: process.env.OVERLEAF_ENABLE_GIT_SYNC === 'true',
+
   // Databases
   // ---------
 

server-ce/k8s/verso-prod-app.yaml

@@ -77,6 +77,8 @@ spec:
             # them). Public self-registration is also off (CE default).
             - name: OVERLEAF_ENABLE_PROJECT_PYTHON_VENV
               value: "true"
+            - name: OVERLEAF_ENABLE_GIT_SYNC
+              value: "true"
           # SMTP for password-reset / invite emails. All OVERLEAF_EMAIL_* vars
           # are loaded from the optional 'verso-smtp' Secret — its keys must be
           # named exactly like these env vars (see the kubectl create secret