[BUG] Plain API content writes bypass push protection in pre-receive

Summary

Plain API content writes are currently treated as bypassed during pre-receive push-protection evaluation.

The repository already distinguishes these operation types:

• GitOpTypeAPIContent
• GitOpTypeAPIContentBypassRules
• GitOpTypeGitPush

But checkPushProtection() now passes AllowBypass=true for all of them, which collapses that distinction for push-protection rules.

Problem

In app/api/controller/githook/pre_receive.go, checkPushProtection() controls whether push rules are evaluated as bypassed.

At the moment, a plain API content operation (GitOpTypeAPIContent) is treated the same as an explicit bypass operation (GitOpTypeAPIContentBypassRules).

That means a bypassable push rule can be marked as bypassed even when the caller did not request bypass semantics.

Why this looks incorrect

The operation-type model still explicitly separates plain API writes from explicit bypass writes:

• app/api/controller/util.go
• app/api/controller/repo/commit.go
• types/enum/githook.go

So the current pre-receive behavior no longer matches the contract implied by those operation types.

Minimal reproduction

I added the following focused regression tests locally in app/api/controller/githook/pre_receive_test.go:

• TestCheckPushProtection_DoesNotBypassForPlainAPIContent
• TestCheckPushProtection_DoesBypassForAPIContentBypassRules

Running:

go test -v ./app/api/controller/githook -run 'TestCheckPushProtection_' -count=1 -timeout 20s

Current result on main:

• TestCheckPushProtection_DoesNotBypassForPlainAPIContent fails
• TestCheckPushProtection_DoesBypassForAPIContentBypassRules passes

Observed failing state for the plain API content case:

• bypassable=true
• bypassed=true

Expected for GitOpTypeAPIContent:

• bypassable=true
• bypassed=false

Expected behavior

AllowBypass in checkPushProtection() should be limited to operation types that explicitly support bypass:

• GitOpTypeAPIContentBypassRules
• GitOpTypeGitPush

Plain GitOpTypeAPIContent should not be treated as bypassed.

Impact

This can allow plain API content mutations (for example, commit-file style API writes) to bypass bypassable push-protection rules even when bypass was not explicitly requested.