missions: fix repo checkout for retries + tokenize git.redclaw.dev clones

- mission_orchestrator: run ensure_checkout BEFORE the team_id
  short-circuit. Previously, a re-launched or retried mission bailed
  out at the team_id=already-bound guard and skipped repo checkout
  entirely, so agents ran against an empty workspace.
- mission_workspace: inject GITEA_TOKEN into git.redclaw.dev URLs so
  clone auth works from the server container. Redact any token
  echoed back on failure.
- refresh buttons on MissionCanvas + MissionsList now spin the icon
  while loading so clicks are visibly acknowledged.
- refresh-spinner keyframe added to motion.css.

Requires operator on gw-04: sudo chown 65532:65532 /var/lib/clawmates-missions
(applied 2026-07-21 pre-commit).

frontend/src/components/dashboard/MissionsList.tsx

@@ -179,11 +179,15 @@ export function MissionsList({
           <button
             type="button"
             onClick={load}
+            disabled={loading}
             title="Refresh"
             aria-label="Refresh"
-            style={iconBtn}
+            style={{ ...iconBtn, opacity: loading ? 0.6 : 1 }}
           >
-            <RotateCw size={13} />
+            <RotateCw
+              size={13}
+              style={loading ? { animation: "cm-spin 1s linear infinite" } : undefined}
+            />
           </button>
           <button
             type="button"