hive reads the forge for nix as its own account, not core

hive-c0re copies the hive's store read token to /run/hyperhive/forge-hive-token
for nix's git credential helper, and no longer mints, reads or falls back to
the core admin token. drops the core user sweep, avatar upload, webhook
cleanup and hive-priv's RunForgeAdmin.

hive-c0re/src/forge/internal_meta.rs

@@ -20,13 +20,20 @@ const CONFIG_BRANCH: &str = "main";
 /// [`MetaSource`] over the forge API.
 pub(crate) struct ForgeSource {
     api: Forgejo,
+    /// Whether the credential file nix's `git` reads holds this hive's token.
+    nix_credential: bool,
 }
 
-/// A source reading as this hive, or `None` when it holds no forge token.
+/// A source reading as this hive, or `None` when it holds no forge token. It
+/// also refreshes the credential file nix's `git` fetches with, which the
+/// build after this read needs to be current.
 pub(crate) async fn internal_meta_source() -> Option<ForgeSource> {
     let token: ReaderToken = super::reader_token().await?;
     match token.api() {
-        Ok(api) => Some(ForgeSource { api }),
+        Ok(api) => Some(ForgeSource {
+            api,
+            nix_credential: token.publish_for_nix(),
+        }),
         Err(e) => {
             tracing::warn!(error = ?e, "internal/meta: cannot build a forge client");
             None
@@ -66,7 +73,7 @@ impl ForgeSource {
 
 impl MetaSource for ForgeSource {
     fn nix_can_fetch(&self) -> bool {
-        super::core_token().is_some()
+        self.nix_credential
     }
 
     async fn meta_head(&self) -> anyhow::Result<Option<String>> {
@@ -106,3 +113,25 @@ impl MetaSource for ForgeSource {
         self.branch_head(CONFIG_ORG, agent, CONFIG_BRANCH).await
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use forgejo_api::Auth;
+
+    fn source(nix_credential: bool) -> ForgeSource {
+        let url = url::Url::parse("http://forge.test").expect("url");
+        ForgeSource {
+            api: Forgejo::new(Auth::None, url).expect("client"),
+            nix_credential,
+        }
+    }
+
+    /// The control (`true`) shows the answer follows the field rather than
+    /// being a constant.
+    #[test]
+    fn nix_fetches_only_where_its_credential_was_published() {
+        assert!(source(true).nix_can_fetch());
+        assert!(!source(false).nix_can_fetch());
+    }
+}