For HTTPS git sources, flux create secret git requires both --username and --password - a token alone is not enough, and the controller reads exactly those two keys. Pass any username (the token is what matters) with the token as --password. For GitHub that is your username plus a classic token with repo scope.

## The error
```text
(flux create secret git refuses HTTPS without a username, or the source fails auth with a password-only secret)
```

## What to do
1. Create the secret with both fields:
```bash
flux create secret git [name] --namespace flux-system \
  --url=https://github.com/[org]/[repo] \
  --username [github-user] --password [token]
```
   Expected: Secret created.
2. Verify the keys:
```bash
kubectl -n flux-system get secret [name] -o jsonpath='{.data}' | tr ',' '\n'
```
   Expected: Shows username and password keys.
3. Reference it from the GitRepository secretRef and reconcile.
   Expected: Source authenticates and goes Ready.

## When this applies
- flux create secret git for HTTPS remotes
- password-only secrets that fail auth
- GitHub/GitLab HTTPS sources

## When it does NOT apply
- SSH git sources (use --private-key-file instead)
- already-correct secrets failing for other reasons

## Works with
flux CLI 2.x

### token-only secret works with plain git but not flux
Plain git accepts token-as-username tricks; the controller wants the literal keys. Same fix.

## Why it happens
source-controller's git client does HTTP basic auth with the secret's username and password keys. A secret missing username has no complete credential, so auth fails even when the token is valid.

## Edge cases
- The username value is ignored by GitHub when a token is the password - any non-empty username works.
- Rotate by recreating the secret and reconciling; the controller picks up the new secret on the next interval.

## Resolved from
gh:fluxcd/flux2#778 - https://github.com/fluxcd/flux2/issues/778