fix(#1868): use HIVE_FORGE_URL for internal forge calls

Replace the hardcoded FORGE_HTTP const with forge_http_base() which
reads HIVE_FORGE_URL from the environment (already set unconditionally
by hive-c0re.nix to http://<forge.domain>). Add forge_git_url() helper
that inserts core:<token> credentials between scheme and authority for
git push/clone URLs.

All call sites updated:
- forge/mod.rs: api() OnceLock + new forge_git_url/forge_http_base fns
- forge/repos.rs: push_meta, push_config, ensure_meta_remote
- forge/pr_merge.rs: tokenised_repo_url delegate + test loosened
- workers/knowledge.rs: clone + push URLs
- socket_server/mod.rs: clone_url in RepoCreated response

No new env var: HIVE_FORGE_URL was already the right knob (mara).

Closes #1868. Closes #2174 (this supersedes the operators-team fix from
the closed #2218, which is re-applied in the ensure_operators_team call
that was already merged separately).

hive-c0re/src/workers/knowledge.rs

@@ -16,6 +16,8 @@ use std::collections::BTreeMap;
 use anyhow::{Context, Result};
 use forgejo_api::structs::{CreateHookOption, CreateHookOptionConfig, CreateHookOptionType};
 
+use crate::forge::forge_git_url;
+
 pub const ORG: &str = "internal";
 pub const REPO: &str = "knowledge";
 
@@ -68,8 +70,7 @@ pub async fn ensure_local_clone(core_token: &str) -> Result<()> {
         return Ok(());
     }
     std::fs::create_dir_all(LOCAL_DIR).context("create knowledge local dir")?;
-    // Embed credentials in the URL — safe for localhost-only forge.
-    let url = format!("http://core:{core_token}@localhost:3000/{ORG}/{REPO}.git");
+    let url = forge_git_url(core_token, &format!("{ORG}/{REPO}"));
     let out = tokio::process::Command::new("git")
         .args(["clone", &url, LOCAL_DIR])
         .output()
@@ -123,7 +124,7 @@ async fn seed_readme(core_token: &str) -> Result<()> {
             anyhow::bail!("git {args:?} failed: {stderr}");
         }
     }
-    let url = format!("http://core:{core_token}@localhost:3000/{ORG}/{REPO}.git");
+    let url = forge_git_url(core_token, &format!("{ORG}/{REPO}"));
     let out = tokio::process::Command::new("git")
         .args(["-C", LOCAL_DIR, "push", &url, "HEAD:main"])
         .output()