swarm-controller: provision a forge user account before adding it as a collaborator

swarm-controller/src/webhook.rs

@@ -116,7 +116,15 @@ fn load_or_generate_at(path: &std::path::Path) -> Result<String> {
 }
 
 /// Read 32 random bytes from `/dev/urandom` and hex-encode them.
-fn generate_hex_secret() -> Result<String> {
+///
+/// `pub(super)` rather than private: `forge::Client::ensure_agent_user`
+/// reuses this for the throwaway account password Forgejo's admin
+/// create-user API requires (unlike the `forgejo admin` CLI's
+/// `--random-password`, the HTTP endpoint has no "generate one for me"
+/// option — see that function's doc comment). Same shape as the webhook
+/// secret above: a value nothing ever reads back, so 32 random bytes is
+/// as good as any other generator.
+pub(super) fn generate_hex_secret() -> Result<String> {
     use std::io::Read as _;
 
     let mut buf = [0u8; 32];