fix(#1868): use HIVE_FORGE_URL for internal forge calls

Replace the hardcoded FORGE_HTTP const with forge_http_base() which
reads HIVE_FORGE_URL from the environment (already set unconditionally
by hive-c0re.nix to http://<forge.domain>). Add forge_git_url() helper
that inserts core:<token> credentials between scheme and authority for
git push/clone URLs.

All call sites updated:
- forge/mod.rs: api() OnceLock + new forge_git_url/forge_http_base fns
- forge/repos.rs: push_meta, push_config, ensure_meta_remote
- forge/pr_merge.rs: tokenised_repo_url delegate + test loosened
- workers/knowledge.rs: clone + push URLs
- socket_server/mod.rs: clone_url in RepoCreated response

No new env var: HIVE_FORGE_URL was already the right knob (mara).

Closes #1868. Closes #2174 (this supersedes the operators-team fix from
the closed #2218, which is re-applied in the ensure_operators_team call
that was already merged separately).

nix/modules/hive-c0re.nix

@@ -984,9 +984,11 @@ in
       )
       // {
         # In-cluster forge URL — the gateway vhost (`forge.<domain>`), which
-        # nginx proxies to forgejo. The forge is mandatory, so this is
-        # unconditional (the whole env block is already gated on hyperhive
-        # being enabled). See `docs/gateway.md::HIVE_FORGE_URL`.
+        # nginx proxies to forgejo. Used both for internal API calls in
+        # hive-c0re (forge/mod.rs `forge_http_base()`) and forwarded to
+        # agents via meta.rs for their forge-notify client. The forge is
+        # mandatory, so this is unconditional (the whole env block is already
+        # gated on hyperhive being enabled). See `docs/gateway.md::HIVE_FORGE_URL`.
         HIVE_FORGE_URL = "http://${config.services.hyperhive.forge.domain}";
       }
       // lib.optionalAttrs config.services.hyperhive.matrix.enable {