fix(#1868): use HIVE_FORGE_URL for internal forge calls

Replace the hardcoded FORGE_HTTP const with forge_http_base() which
reads HIVE_FORGE_URL from the environment (already set unconditionally
by hive-c0re.nix to http://<forge.domain>). Add forge_git_url() helper
that inserts core:<token> credentials between scheme and authority for
git push/clone URLs.

All call sites updated:
- forge/mod.rs: api() OnceLock + new forge_git_url/forge_http_base fns
- forge/repos.rs: push_meta, push_config, ensure_meta_remote
- forge/pr_merge.rs: tokenised_repo_url delegate + test loosened
- workers/knowledge.rs: clone + push URLs
- socket_server/mod.rs: clone_url in RepoCreated response

No new env var: HIVE_FORGE_URL was already the right knob (mara).

Closes #1868. Closes #2174 (this supersedes the operators-team fix from
the closed #2218, which is re-applied in the ensure_operators_team call
that was already merged separately).

hive-c0re/src/forge/pr_merge.rs

@@ -9,7 +9,7 @@ use forgejo_api::structs::{MergePullRequestOption, MergePullRequestOptionDo};
 
 use crate::coordinator::Coordinator;
 
-use super::{CONFIG_ORG, api, core_token};
+use super::{CONFIG_ORG, api, core_token, forge_git_url};
 
 // ---------------------------------------------------------------------------
 // PR-based config-flow merge primitives (part of the
@@ -81,7 +81,7 @@ fn repo_agent_name(repo: &str) -> &str {
 /// `push_config`'s pattern; the token is passed straight to git and never
 /// stored as a named remote.
 fn tokenised_repo_url(repo: &str, token: &str) -> String {
-    format!("http://core:{token}@localhost:3000/{repo}.git")
+    forge_git_url(token, repo)
 }
 
 /// Resolve a PR's head sha via `git ls-remote <repo> refs/pull/<pr>/head`
@@ -311,9 +311,13 @@ mod tests {
 
     #[test]
     fn tokenised_repo_url_shape() {
-        assert_eq!(
-            tokenised_repo_url("agent-configs/iris", "tok"),
-            "http://core:tok@localhost:3000/agent-configs/iris.git"
+        // Credentials are inserted between scheme and authority; fallback
+        // base is `http://localhost:3000` when HIVE_FORGE_URL is unset.
+        let url = tokenised_repo_url("agent-configs/iris", "tok");
+        assert!(url.contains("core:tok@"), "must embed credentials: {url}");
+        assert!(
+            url.ends_with("/agent-configs/iris.git"),
+            "must end with repo path: {url}"
         );
     }
 }